jvoisin/php-malware-finder

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

1475 stars · 277 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PHP Malware Finder is a command-line tool that scans filesystems for potentially malicious PHP files using YARA rules. It detects obfuscated code, webshells, and common malware patterns through semantic analysis rather than hash matching.

Use cases

• scan a web server for uploaded webshells
• detect obfuscated PHP malware in a codebase
• clean up a compromised website
• audit PHP files for suspicious function usage
• find backdoors planted by attackers in a CMS
• hunt for known webshell families like Weevely3 or novahot

When to choose

• you need to triage a potentially compromised PHP web server
• you want semantic detection that catches obfuscated and mutated malware, not just known hashes
• you want a simple, fast filesystem scanner with YARA rules you can extend

When to avoid

• you need guaranteed protection against sophisticated, tailored malware (the tool is explicitly bypassable)
• you need runtime protection rather than on-disk file scanning
• your stack is not PHP-based

Facets

cli-tool · maturity active

security vulnerability-scanning search-engine security web-development developer-tools cli cross-platform yara webshell-detection php-malware antivirus obfuscation-detection linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="jvoisin/php-malware-finder")