Composer · packagist.org
plutonium/pocketmine-mp
Php Base64 Eval Chain: base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload.
Why PkgRadar flagged 5.115.9
| Severity | Signal | Evidence |
|---|---|---|
| high | Php Base64 Eval Chain | base64/gz/hex decode combined with eval/exec/backticks — classic PHP obfuscated payload. · Plutonium-Mcpe-PocketMine-MP-64929ee/src/console/ConsoleReaderChildProcessDaemon.php |
| high | Php Shell With Decode | exec / system / shell_exec combined with base64/hex decode. · Plutonium-Mcpe-PocketMine-MP-64929ee/src/console/ConsoleReaderChildProcessDaemon.php |
| medium | Remote Payload | matched "github.com/$argv[3]/releases/download" · Plutonium-Mcpe-PocketMine-MP-64929ee/build/generate-build-info-json.php |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
5.115.9 | Review | 27 | 2026-06-09 |
5.115.7 | Review | 27 | 2026-06-07 |
5.115.6 | Review | 27 | 2026-06-02 |
Block this in CI
pkgradar gate --ecosystem composer plutonium/[email protected]