We have a client who is very concerned with Malicious code being introduced in third party modules, especially modules that are coming from Magento Connect (Or any free module) They would like to use one of these modules but want to be assured that the module does not contain code that would allow a hacker to get access to different parts of their Magento site.

My question is this: Is there a tool that we could use to scan code for content? Something like this but maybe more in depth.

function check($contents,$file) {
        $this->scanned_files[] = $file;
        if(preg_match('/eval\((base64|eval|\$_|\$\$|\$[A-Za-z_0-9\{]*(\(|\{|\[))/i',$contents)) {
            $this->infected_files[] = $file;

Even a service that can be run on the web server.

Ideally if there was a service that would scan each commit before code got into the repo would be ideal.

  • Great question. I'm paranoid by nature and when installing a new module, I go and check the code to see if there is anything suspicious. The problem I guess is for those who don't know what they are looking for. Kind of like all those flashlight apps that access your phones camera and/or microphone. You don't know until its too late or take a serious look at what you're installing. That being said, I hope someone can come up with a solution OR that Magento Connect becomes much more strenuous on the modules they allow.
    – SR_Magento
    Apr 3, 2015 at 22:34
  • 1
    Can't they just pay you to download and then code review before uploading to the merchant site without using Connect? Apr 4, 2015 at 10:08

6 Answers 6


Had you thought about running clamav? - https://www.clamav.net/index.html - I ran this recently on a clients Ubuntu server running magento and it came back with two infected files - speed of the scan was impressive and is easily run if you have SSH access - you could also run regularly via a Cron job.

To run clam AV on Ubuntu

To install ClamAV run the following command

apt-get update
apt-get install clamav

Manually update virus databases


You will see ClamAV update process started To manually scan files/folders for viruses

clamscan -r --bell -i /

For those not on Ubuntu full instructions can be found here https://www.clamav.net/doc/install.html

  • Add that to Linux Malware Detect which does one level of scan and then ties in with ClamAV to finish out the attempt to flush out php application nasties. Apr 26, 2015 at 3:58
  • FYI Clam does not detect most of the latest Magento malware. Also, most malware is hidden in de database, specifically in these tables: core_config_data, cms_blocks, cms_pages. So you should dump these to a file and scan that.
    – Willem
    Sep 22, 2018 at 8:58

There are many ways to obfuscate code so such a simple solution is not a solution at all IMO. If you really want to lock down your system and prevent malicious code I would recommend:

  1. Do not allow installation of modules via Connect. Use a git repo and install first on a staging server and only update production via git after thorough testing and inspection.

  2. Never ever allow use of modules with obfuscated code, no matter who the developer is. Ask for an unobfuscated copy or just look elsewhere. I sympathize with extension developers wanting to prevent piracy, but if you are concerned about security it is a deal-breaker.

  3. If possible restrict outbound traffic via iptables. This is hard since there are so many third-party APIs to integrate with and they can change their IPs at any time, but it is the most sure way to prevent malicious code (Magento or otherwise) from reaching out.

  4. Install a tool which monitors your web root for file changes. For example, ConfigServer Firewall and OSSEC have components which do this well, after proper configuration, of course.

If you happen to know of a system that will refresh iptables entries or AWS Security Groups when DNS records update please let me know since I haven't found or built one myself yet..

  • Thank Colin, that doesn't actually answer the question: We do 1 and 2. Number three is after the fact and doesn't deal with the scanning of the code. #4 is just a comparison of the existing code. We have clamAV as well as Sophus but that missed two files. Apr 10, 2015 at 12:18

Try the Magento Malware Scanner, which contains the largest collection of malware signatures that is publicly available. It downloads the latest signatures, handles whitelists and keeps state.

It is recommended by Magento, used by Magento Marketplace, Homeland Security, VISA and many others.


I created a module called MB_Callinghome to do exactly that. The extension is quite simple, it observes the admin login event and search for a configurable string with find and grep. The extension uses exec() which makes it only usable in a staging environment since it might expose the site to an attack if used in prod.


You could perhaps look into using PHP_CodeSniffer or a similar coding standard tool. You would of course need to have a strong understanding of inner workings of what should be considered safe, but you can set it up such that code sniffer would then flag problematic files.

I recall there was a question on here in regards to why the standards used by the module here https://github.com/magento-ecg/coding-standard is so sensitive about thigs like fopen and other file i/o operations.

Using it, you could at least identify what you might wish to consider dangerous code. It would however ultimately still require a review of the code base. Anything which gets flagged up there might be a legitimate code for the purposes of the modules operation. So you cannot rely purely on automatic testing for something of this nature unfortunately.


There are free online tools you can use to scan your Magento installation remotely. These can help you identify credit card swipers, malicious payloads, intermediary domains, and other security issues.








Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.