PkgRadar

Composer · packagist.org

chameleon-system/chameleon-base

Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.

Why PkgRadar flagged 8.0.66

SeveritySignalEvidence
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/library/classes/TCMSListManager/TCMSListManagerFullGroupTable.class.php
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/library/classes/TTools/TTools.class.php
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/modules/CMSTableExport/CMSTableExport.class.php
highPhp Backtick With DecodeBacktick shell-out combined with base64/hex decode. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/library/classes/TCMSListManager/TCMSListManagerFullGroupTable.class.php
highPhp Backtick With DecodeBacktick shell-out combined with base64/hex decode. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/library/classes/TTools/TTools.class.php
highPhp Backtick With DecodeBacktick shell-out combined with base64/hex decode. · chameleon-system-chameleon-base-a87956d/src/CoreBundle/private/modules/CMSTableExport/CMSTableExport.class.php

Scanned versions

VersionVerdictScoreScanned (UTC)
8.0.66Review302026-06-10
8.0.64Review302026-06-03
8.0.63Review302026-05-28
8.0.62Review302026-05-28

Block this in CI

PkgRadar gates chameleon-system/chameleon-base (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer chameleon-system/[email protected]
Start free — 25 scans / moView full evidence
chameleon-system/chameleon-base — Composer security scan | PkgRadar