PHPackages                             mage2kishan/module-malware-scanner - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. mage2kishan/module-malware-scanner

ActiveMagento2-module[Security](/categories/security)

mage2kishan/module-malware-scanner
==================================

Active malware prevention + on-disk scanner for Magento 2. Three real-time guards (REST API, universal upload, custom-options) block PolyShell webshells, polyglot files and PHP-object-injection payloads BEFORE they touch disk. A nightly recursive scanner finds anything that slipped through, auto-quarantines critical findings inside writable upload zones, and ships with a built-in vendor allowlist that prevents false positives on legitimate composer dependencies. Includes admin grid, in-admin documentation, signature catalog and email notifications.

1.1.2(1mo ago)559↓66.7%21proprietaryPHPPHP ~8.1.0||~8.2.0||~8.3.0||~8.4.0

Since Apr 17Pushed 1mo agoCompare

[ Source](https://github.com/mage2sk/module-malware-scanner)[ Packagist](https://packagist.org/packages/mage2kishan/module-malware-scanner)[ Docs](https://kishansavaliya.com)[ RSS](/packages/mage2kishan-module-malware-scanner/feed)WikiDiscussions main Synced 3w ago

READMEChangelogDependencies (18)Versions (10)Used By (1)

Magento 2 Malware Scanner: Real-Time Upload Guards, File Scanning, and Auto-Quarantine (Hyva + Luma)
====================================================================================================

[](#magento-2-malware-scanner-real-time-upload-guards-file-scanning-and-auto-quarantine-hyva--luma)

[![Magento 2.4.4 - 2.4.8](https://camo.githubusercontent.com/079c832211eed4f9451ebe264e3865f825b0f9f31b041cbf03676c6e254535d4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342e342532302d2d253230322e342e382d6f72616e67653f6c6f676f3d6d6167656e746f266c6f676f436f6c6f723d7768697465)](https://magento.com)[![PHP 8.1 - 8.4](https://camo.githubusercontent.com/56b3cce18841623e2cbed2ebf09b06be1be8807e99e6e054a89d304ab4790b8e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e312532302d2d253230382e342d626c75653f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://php.net)[![Hyva + Luma](https://camo.githubusercontent.com/d4d6a05401973034a5aae392f030440eefa40afc9191ffb06ed897af5d25adb1/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5468656d65732d487976612532302532422532304c756d612d313462386136)](https://www.hyva.io)[![Live Demo & Details](https://camo.githubusercontent.com/be4f64352d6f45db2ec4bcc794ad1e9b75214fddd601bfd01adffe5dd90e745c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c69766525323044656d6f25323025323625323044657461696c732d6d6167656e746f2d2d322d2d6d616c776172652d2d7363616e6e65722d3044393438383f7374796c653d666c6174)](https://kishansavaliya.com/magento-2-malware-scanner.html)[![Packagist](https://camo.githubusercontent.com/6f01143bb5c387e979b91bbe71e851230d6922d1e5d162f3f9dcca1275b70f60/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5061636b61676973742d6d616765326b697368616e2532466d6f64756c652d2d6d616c776172652d2d7363616e6e65722d6f72616e67653f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/mage2kishan/module-malware-scanner)[![Upwork Top Rated Plus](https://camo.githubusercontent.com/6f72584179420c41ed90432fd2579a4ed36199d4229e8181d20f353c1c4ee4eb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5570776f726b2d546f702532305261746564253230506c75732d3134613830303f6c6f676f3d7570776f726b266c6f676f436f6c6f723d7768697465)](https://www.upwork.com/freelancers/~016dd1767321100e21)[![Website](https://camo.githubusercontent.com/f1ae86d28e2b505aee60f240d3e5508e390b0a8dc7a9b7ecf1b450fad862053f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f576562736974652d6b697368616e736176616c6979612e636f6d2d304439343838)](https://kishansavaliya.com)

> **Protect your Magento 2 store from malware, webshells, and file-upload attacks.** Panth Malware Scanner runs 11 inline guard plugins that block PolyShell payloads, polyglot files, and PHP injection attempts before they touch disk, then runs a nightly recursive scan of your codebase and auto-quarantines critical findings in writable upload zones.

**Product page:** [kishansavaliya.com/magento-2-malware-scanner.html](https://kishansavaliya.com/magento-2-malware-scanner.html)

---

Quick Answer
------------

[](#quick-answer)

**What is Panth Malware Scanner?** It is a Magento 2 security extension that combines 11 real-time upload and request guards with a signature-based on-disk scanner, auto-quarantine, and email alerts, so malicious files are stopped at the framework layer and anything that slips through is caught in the next scan.

**What does it add to my store?**

- **11 real-time guard plugins** covering every Magento upload channel, REST API, GraphQL, and custom option uploads.
- **Signature-based recursive scanner** that checks your entire Magento codebase against regex, literal, filename, and pathglob signatures.
- **Auto-quarantine** for critical findings inside writable upload zones, with a two-tier removal flow (move to quarantine or hard delete).
- **Admin findings grid and blocked-request log** so you can review every detection and blocked attack in one place.
- **Email notifications** when a scan or guard blocks something at or above your configured severity level.

**Which themes are supported?** The module works on **Hyva** and **Luma** storefronts. It is a security layer with no storefront UI of its own.

**What does it need?** Magento 2.4.4 to 2.4.8, PHP 8.1 to 8.4, and the free `mage2kishan/module-core` package.

---

Live Proof: PolyShell Attacks Blocked on Our Own Stores
-------------------------------------------------------

[](#live-proof-polyshell-attacks-blocked-on-our-own-stores)

The screenshots below were captured on a production Magento 2.4.8 store running Panth Malware Scanner during the active **PolyShell** (APSB25-94) exploitation wave that started March 17, 2026. Every row is a real attacker request that hit the store and was shut down at the framework layer, before any webshell executed.

 [![Panth Malware Scanner admin grid showing 807 blocked malicious requests — real PolyShell attacks against a live Magento 2.4.8 store, April 2026. Attackers targeted /media/custom_options/quote/*.php and /rest/V1/guest-carts endpoints; each request blocked with polyshell-path and base64:R0lGODlh signatures.](docs/images/polyshell-attacks-blocked-live.png)](docs/images/polyshell-attacks-blocked-live.png)

**What you are seeing:** 807 blocked malicious requests across 41 pages. Attackers probed `/media/custom_options/quote/*.php`, POST bodies starting with `