PkgRadar

Composer · packagist.org

michaelalexeevweb/openapi-php-dto-generator

Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.

Why PkgRadar flagged 2.2.10

SeveritySignalEvidence
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · michaelalexeevweb-openapi-php-dto-generator-4bba9b4/src/Service/DtoValidator.php
highPhp Backtick With DecodeBacktick shell-out combined with base64/hex decode. · michaelalexeevweb-openapi-php-dto-generator-4bba9b4/src/Service/DtoValidator.php

Scanned versions

VersionVerdictScoreScanned (UTC)
2.2.10High risk752026-06-10
2.2.9High risk752026-06-09
2.2.6High risk752026-06-09
2.2.5High risk752026-06-08
2.2.4High risk752026-06-08
2.2.0High risk752026-06-08
2.1.11High risk752026-06-03
2.1.7High risk752026-06-03
2.1.4Low risk02026-06-01
2.1.2Low risk02026-06-01
2.1.1Low risk02026-06-01

Block this in CI

PkgRadar gates michaelalexeevweb/openapi-php-dto-generator (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer michaelalexeevweb/[email protected]
Start free — 25 scans / moView full evidence