Has Magento become Obese?

Has Magento become Obese?

The un-controlled file structure with more than 70,000 files is making Magento CE vulnerable to malicious attacks. Magento need organised and well-audited growth before it crumbles under its own weight

In July 2019 Many of the Magento based eCommerce shops were hit by the dreaded "Magento Killer" virus. Some of them also included high profile jewellery websites developed by TransPacific Software.
The Magento Killer changes core settings in the infected Magento installations, stealing credit Cart and client information

We patched and cleaned them but decided to go a step ahead. Investigate why worldwide Magento sites are hit regularly by malicious scripts.
Our Python team decided to build a bot to deep dive in Magento 2.3.
One of the biggest problems with Magento we spotted was; uncontrolled growth of its folder and file structure. More than 70,0000 files. Many were redundant. Many inviting hackers to exploit them and many a deadwood.

Files Magento 2.3..2 Woocommerce + WP 5.2.2.
PHP 46040 2609
CSS 335 597
JS 2422 850
Others 21292 884
Total Files 70089 4940
The direct result of such uncontrolled growth of Magento size is:
  • Requires at least a VPS 8GB server to run it
  • The file structure is nothing less than a quagmire of maze.
  • Open backdoors for hackers and spammers.

Here is a deep dive document on Magento 2.3.2 default installation File structure:

File Types -

  • Total .sample files - 6
  • Total .txt files - 3
  • Total .ini files - 1
  • Total .php files - 1
  • Total .yml files - 1
  • Total .lock files - 1
  • Total .json files - 1
  • Total .htaccess files - 1
  • Total .md files - 1
  • Total .gitignore files - 1
  • Total .dist files - 1

File Types -

  • Total .php files - 5753
  • Total .xml files - 1756
  • Total .js files - 203
  • Total .csv files - 103
  • Total .txt files - 66
  • Total .json files - 48
  • Total .jpg files - 32
  • Total .html files - 25
  • Total .dist files - 23
  • Total .png files - 21
  • Total .gif files - 21
  • Total .less files - 20
  • Total .css files - 17
  • Total .gitignore files - 12
  • Total .phtml files - 12
  • Total .sample files - 8
  • Total .htaccess files - 7
  • Total .graphqls files - 6
  • Total .file files - 6
  • Total .xsd files - 5
  • Total .lock files - 4
  • Total README files - 3
  • Total .zip files - 3
  • Total .sh files - 2
  • Total .ico files - 2
  • Total .md files - 2
  • Total .vcl files - 2
  • Total file files - 2
  • Total apache_virtual_host files - 1
  • Total .conf files - 1
  • Total mtf files - 1
  • Total magento files - 1
  • Total .docx files - 1
  • Total .svg files - 1
  • Total .sql files - 1
  • Total .bmp files - 1
  • Total .swf files - 1
  • Total .jscsrc files - 1
  • Total .eslintrc-magento files - 1
  • Total .eslintrc-reset files - 1
  • Total .eslintrc files - 1
  • Total edition files - 1
  • Total .tgz files - 1
  • Total 0 files - 1

File Types -

  • Total .htaccess files - 1
  • Total magento files - 1

File Types -

  • Total .php files - 1
  • Total .htaccess files - 1
  • Total .md files - 1

File Types -

  • Total .php files - 37178
  • Total .xml files - 7967
  • Total .js files - 1651
  • Total .md files - 1165
  • Total .phtml files - 1090
  • Total .txt files - 943
  • Total .json files - 651
  • Total .gif files - 617
  • Total .less files - 516
  • Total .html files - 485
  • Total .yml files - 465
  • Total .csv files - 325
  • Total .inc files - 306
  • Total .png files - 276
  • Total .css files - 265
  • Total .xsd files - 221
  • Total .phpt files - 201
  • Total .gitignore files - 158
  • Total LICENSE files - 136
  • Total .fixed files - 128
  • Total .dist files - 125
  • Total .mustache files - 52
  • Total .jpg files - 49
  • Total .rst files - 44
  • Total .feature files - 42
  • Total .lock files - 40
  • Total .htm files - 33
  • Total .htaccess files - 32
  • Total .asciidoc files - 32
  • Total .graphqls files - 32
  • Total .svg files - 30
  • Total .gitkeep files - 22
  • Total .gitattributes files - 19
  • Total .php_cs files - 18
  • Total .ttf files - 18
  • Total .woff files - 17
  • Total .sample files - 16
  • Total .woff2 files - 14
  • Total .expected files - 14
  • Total .sh files - 13
  • Total .ini files - 12
  • Total .neon files - 11
  • Total .sql files - 11
  • Total .bat files - 10
  • Total .conf files - 10
  • Total .eot files - 10
  • Total .dot files - 10
  • Total .editorconfig files - 9
  • Total Makefile files - 8
  • Total .twig files - 8
  • Total .ico files - 8
  • Total .wsdl files - 7
  • Total install files - 6
  • Total .vcl files - 6
  • Total .file files - 6
  • Total README files - 5
  • Total .example files - 5
  • Total .xhtml files - 5
  • Total .gitmodules files - 4
  • Total .yaml files - 4
  • Total src files - 4
  • Total tests files - 4
  • Total .dat files - 4
  • Total modman files - 3
  • Total .phar files - 3
  • Total .phps files - 3
  • Total .map files - 3
  • Total .copy files - 3
  • Total .htc files - 3
  • Total .zip files - 3
  • Total lessc files - 2
  • Total mftf files - 2
  • Total phpcpd files - 2
  • Total phpcbf files - 2
  • Total validate-json files - 2
  • Total pdepend files - 2
  • Total phpmd files - 2
  • Total codecept files - 2
  • Total jsonlint files - 2
  • Total composer files - 2
  • Total release files - 2
  • Total phpunit files - 2
  • Total phpcs files - 2
  • Total robo files - 2
  • Total cssmin files - 2
  • Total php-cs-fixer files - 2
  • Total NOTICE files - 2
  • Total .properties files - 2
  • Total Vagrantfile files - 2
  • Total Dockerfile files - 2
  • Total AUTHORS files - 2
  • Total magento files - 2
  • Total .pem files - 2
  • Total .flf files - 2
  • Total .rng files - 2
  • Total .stub files - 2
  • Total .jmx files - 2
  • Total a files - 2
  • Total test files - 2
  • Total .unknownextension files - 2
  • Total .ms files - 2
  • Total .empty files - 2
  • Total .xsl files - 2
  • Total .swf files - 2
  • Total file1 files - 2
  • Total file files - 2
  • Total .markdown files - 1
  • Total .spec files - 1
  • Total CREDITS files - 1
  • Total VERSION files - 1
  • Total .mailmap files - 1
  • Total CHANGELOG files - 1
  • Total NEWS files - 1
  • Total COPYING files - 1
  • Total BLURB files - 1
  • Total .adoc files - 1
  • Total .TXT files - 1
  • Total .full files - 1
  • Total PORTING_INFO files - 1
  • Total .tpl files - 1
  • Total Rakefile files - 1
  • Total LICENSE_GECKO files - 1
  • Total LICENSE_DIFF files - 1
  • Total .test files - 1
  • Total TODO files - 1
  • Total .otf files - 1
  • Total .py files - 1
  • Total bin files - 1
  • Total .pubkey files - 1
  • Total .asc files - 1
  • Total .in files - 1
  • Total phpunit-checks files - 1
  • Total static-checks files - 1
  • Total all-checks files - 1
  • Total copyright-check files - 1
  • Total compile files - 1
  • Total .cnf files - 1
  • Total update_i18n files - 1
  • Total .tokens files - 1
  • Total SAMI_VERSION files - 1
  • Total PROJECT_VERSION files - 1
  • Total .index files - 1
  • Total .exe files - 1
  • Total no-extension files - 1
  • Total test_groups files - 1
  • Total php70Test files - 1
  • Total whitespace_group_test files - 1
  • Total group_1 files - 1
  • Total .db files - 1
  • Total group_3 files - 1
  • Total group_2 files - 1
  • Total php55Test files - 1
  • Total .combine files - 1
  • Total runner files - 1
  • Total .crt files - 1
  • Total .pdf files - 1
  • Total .hiddenFile files - 1
  • Total .xlsm files - 1
  • Total .tmpl files - 1
  • Total .env files - 1
  • Total db files - 1
  • Total ignore_prefixes files - 1
  • Total apache_virtual_host files - 1
  • Total Bugs files - 1
  • Total Readme files - 1
  • Total mtf files - 1
  • Total MIT-LICENSE files - 1
  • Total .weird files - 1
  • Total .WEIRD files - 1
  • Total groupFileTest1 files - 1
  • Total .docx files - 1
  • Total .bmp files - 1
  • Total .LICENSE files - 1
  • Total file2 files - 1
  • Total .jbf files - 1
  • Total .jscsrc files - 1
  • Total .eslintrc-magento files - 1
  • Total .eslintrc-reset files - 1
  • Total .eslintrc files - 1
  • Total edition files - 1
  • Total .tgz files - 1
  • Total 0 files - 1
  • Total .keep files - 1
  • Total content files - 1

File Types -

  • Total .js files - 304
  • Total .html files - 24
  • Total .php files - 11
  • Total .css files - 10
  • Total .woff2 files - 9
  • Total .htaccess files - 8
  • Total .gif files - 6
  • Total .phtml files - 5
  • Total .ico files - 3
  • Total .json files - 3
  • Total .svg files - 3
  • Total .jpeg files - 2
  • Total .ini files - 1
  • Total .txt files - 1
  • Total .sample files - 1
  • Total .xml files - 1

File Types -

  • Total .php files - 8
  • Total .xml files - 2
  • Total .htaccess files - 1

File Types -

  • Total .gif files - 506
  • Total .js files - 212
  • Total .png files - 109
  • Total .less files - 80
  • Total .css files - 33
  • Total .html files - 27
  • Total .ttf files - 9
  • Total .woff files - 9
  • Total .txt files - 8
  • Total .woff2 files - 6
  • Total .svg files - 5
  • Total .htc files - 3
  • Total .md files - 2
  • Total .eot files - 2
  • Total .htaccess files - 1
  • Total Bugs files - 1
  • Total Readme files - 1
  • Total .csv files - 1
  • Total .json files - 1
  • Total README files - 1
  • Total MIT-LICENSE files - 1
  • Total .jpg files - 1
  • Total .jbf files - 1

File Types -

  • Total .php files - 634
  • Total .js files - 39
  • Total .phtml files - 32
  • Total .xml files - 24
  • Total .svg files - 9
  • Total .htaccess files - 6
  • Total .gitignore files - 6
  • Total .csv files - 5
  • Total .eot files - 5
  • Total .woff2 files - 5
  • Total .ttf files - 5
  • Total .woff files - 5
  • Total .txt files - 3
  • Total .map files - 3
  • Total .gif files - 3
  • Total .png files - 3
  • Total .less files - 3
  • Total .jmx files - 2
  • Total .json files - 2
  • Total .html files - 2
  • Total .md files - 1
  • Total .css files - 1
  • Total .ico files - 1
  • Total .keep files - 1
  • Total content files - 1

File Types -

  • Total .md files - 7
  • Total .htaccess files - 1

File Types -

  • Total .php files - 1872
  • Total .phpt files - 204
  • Total .md files - 150
  • Total .xml files - 109
  • Total .json files - 94
  • Total .txt files - 81
  • Total LICENSE files - 45
  • Total .dist files - 41
  • Total .gitignore files - 38
  • Total .yml files - 25
  • Total .php_cs files - 14
  • Total .js files - 13
  • Total .gitattributes files - 11
  • Total .svg files - 10
  • Total .html files - 9
  • Total .png files - 7
  • Total .eot files - 6
  • Total .woff2 files - 6
  • Total .ttf files - 6
  • Total .woff files - 6
  • Total .htaccess files - 5
  • Total .neon files - 5
  • Total .css files - 4
  • Total .dat files - 4
  • Total .lock files - 3
  • Total .editorconfig files - 3
  • Total .copy files - 3
  • Total .ico files - 2
  • Total .gif files - 2
  • Total .exe files - 2
  • Total .phar files - 2
  • Total a files - 2
  • Total .sh files - 1
  • Total .mdown files - 1
  • Total PORTING_INFO files - 1
  • Total .xsd files - 1
  • Total phpunit files - 1
  • Total validate-json files - 1
  • Total jsonlint files - 1
  • Total .pem files - 1
  • Total composer files - 1
  • Total compile files - 1
  • Total .map files - 1
  • Total .tokens files - 1
  • Total .w32 files - 1
  • Total .c files - 1
  • Total .m4 files - 1
  • Total .h files - 1
  • Total .bin files - 1
  • Total .wsdl files - 1
  • Total .dot files - 1
  • Total .phtml files - 1
  • Total .gitkeep files - 1
  • Total .inc files - 1

File Types -

  • Total .php files - 582
  • Total .htaccess files - 1

Total Pre-installed active extensions

Total number of default extensions with Names -

Plugin name - MSP_ReCaptcha
Plugin name - Amazon_Core
Plugin name - Amazon_Login
Plugin name - Amazon_Payment
Plugin name - Dotdigitalgroup_Email
Plugin name - Klarna_Core
Plugin name - Klarna_Ordermanagement
Plugin name - Klarna_Kp
Plugin name - MSP_TwoFactorAuth
Plugin name - Temando_Shipping
Plugin name - Vertex_Tax