# jvoisin/php-malware-finder

Detect potentially malicious PHP files

Repository: https://github.com/jvoisin/php-malware-finder
Canonical: https://ross.abutalabs.com/products/php-malware-finder
Language: PHP
License: LGPL-3.0
License Family: copyleft
Topics: yara, php, malware, webshell, antivirus
Archived: true
Last push: 2023-10-20T16:02:54+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 4080, "days_push": 1048, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1475, forks 277 (observed 2026-08-28T04:04:49.769394+00:00)

## What it is
PHP Malware Finder is a command-line tool that scans filesystems for potentially malicious PHP files using YARA rules. It detects obfuscated code, webshells, and common malware patterns through semantic analysis rather than hash matching.

## Use cases
- scan a web server for uploaded webshells
- detect obfuscated PHP malware in a codebase
- clean up a compromised website
- audit PHP files for suspicious function usage
- find backdoors planted by attackers in a CMS
- hunt for known webshell families like Weevely3 or novahot

## When to choose
- you need to triage a potentially compromised PHP web server
- you want semantic detection that catches obfuscated and mutated malware, not just known hashes
- you want a simple, fast filesystem scanner with YARA rules you can extend

## When to avoid
- you need guaranteed protection against sophisticated, tailored malware (the tool is explicitly bypassable)
- you need runtime protection rather than on-disk file scanning
- your stack is not PHP-based

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, search-engine
- domain: security, web-development, developer-tools
- platform: cli, cross-platform
- tags: yara, webshell-detection, php-malware, antivirus, obfuscation-detection, linux, macos

## Member repositories
- jvoisin/php-malware-finder (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:49.769394+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:34:31.228806+00:00, confidence not recorded.
  - readme: https://github.com/jvoisin/php-malware-finder (fetched 2026-08-28T04:04:49.769394+00:00, sha 7a8750baed9a)
- Data as of 2026-08-30T08:39:29.467469+00:00.