PkgRadar

Composer · packagist.org

keyqcloud/kyte-php

Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.

Why PkgRadar flagged v4.9.0

SeveritySignalEvidence
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · keyqcloud-kyte-php-796f3e8/src/Core/Api.php

Scanned versions

VersionVerdictScoreScanned (UTC)
v4.9.0High risk402026-06-01
v4.8.1High risk402026-06-01
v4.8.0High risk402026-05-31
v4.7.0High risk402026-05-30
v4.6.0High risk402026-05-30
v4.6.1High risk402026-05-30

Block this in CI

PkgRadar gates keyqcloud/kyte-php (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer keyqcloud/[email protected]