PkgRadar

Composer · packagist.org

plutonium/pocketmine-mp

Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.

Why PkgRadar flagged 5.115.9

SeveritySignalEvidence
highPhp Base64 Eval Chainbase64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · Plutonium-Mcpe-PocketMine-MP-64929ee/src/console/ConsoleReaderChildProcessDaemon.php
highPhp Shell With Decodeexec / system / shell_exec combined with base64/hex decode. · Plutonium-Mcpe-PocketMine-MP-64929ee/src/console/ConsoleReaderChildProcessDaemon.php
mediumRemote Payloadmatched "github.com/$argv[3]/releases/download" · Plutonium-Mcpe-PocketMine-MP-64929ee/build/generate-build-info-json.php

Scanned versions

VersionVerdictScoreScanned (UTC)
5.115.9Review272026-06-09
5.115.7Review272026-06-07
5.115.6Review272026-06-02

Block this in CI

PkgRadar gates plutonium/pocketmine-mp (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem composer plutonium/[email protected]