This is the mod Lee is talking about
:
https://vborg.vbsupport.ru/showthread.php?t=265866
Although he is a little mistaken about what it does... it
only scans all plugins for the string "base64" and if found reports the plugin as compromised because there has never been legit reason for base64 encoding to be used in plugins and 99.9% of the time it means a plugin was hacked.
I suggest eliminating the base64 encoding if possible or going back to having the code in a php file instead of a plugin.