scr34m/php-malware-scanner

This is a command-line and embeddable PHP malware scanner. Its main workflow accepts a directory and scan options, traverses eligible files, checks them against signature rules (or the alternative base64 rules), consults hash whitelists, and formats findings and scan statistics. Additional documented capabilities include WordPress checksum whitelisting, a combined whitelist, and optional AST-based checks. The scanner is largely implemented in scan.php; the excerpts omit some internals, so uncertain call wiring is not shown.