The fix, in one snippet
unzip -l package.zip | grep -Ei '\.(exe|scr|bat|cmd|ps1|js|vbs|lnk)$'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner lists entries recursively within the depth limit and, for each, checks both the extension and the magic bytes of the decompressed data: PE, ELF and Mach-O binaries, .msi, .scr, .bat, .cmd, .vbs, .js, .jse, .wsf, .hta, .ps1, .lnk, .jar, .apk, .dmg and .pkg. It reports the entries and flags two patterns at high severity: a single executable with a document-style name, and one visible shortcut alongside a hidden folder holding a DLL or executable, which is the layout of many recent droppers. Limits: only entries that can be decompressed are sniffed; a zip of a website or a code project will contain .js files legitimately, so look at whether the executable is the only thing in the archive.
Why it matters
Gmail and Outlook refuse bare executables and Gmail also blocks them inside zips, so attackers use scripts and shortcuts that Windows runs on double-click: scan_document.pdf.js opens in Windows Script Host, Invoice.lnk runs whatever command line it contains. A .js or .vbs in an archive that claims to be a document is one of the most reliable phishing indicators there is. Windows users are the target; the scripting hosts and shortcut handling that make this work are Windows features.
How to fix it
Do not extract and run it. If you were expecting software, download it from the vendor's site or store and compare hashes. A durable hardening for Windows is to make script files open in Notepad instead of executing: right-click a .js file > Open with > choose Notepad > Always. Or disable Windows Script Host for the user:
reg add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 0 /fRelated checks: Windows shortcut files and executable files. Guides: disguised files and archives and zip bombs.
Where this fits
Archive contains an executable is check 3 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Script contains download-and-execute commands (critical), where the script contains commands that download and execute code or tamper with system defences, such as PowerShell IEX with a web request, certutil -urlcache or mshta with a remote URL. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Archive contains an executable closes one route in. Immediately below it: Decompression bomb, where the archive declares an uncompressed size vastly larger than its compressed size, so extracting it could fill your disk or freeze whatever tries to scan it; Double file extension, where the filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a disguise that depends on Windows hiding known extensions; Executable embedded inside another file, where an executable program is embedded inside a file of another type, such as a Windows binary hidden in a PDF, an Office document, an RTF or an image.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Archive contains an executable (high severity)
Scanner check id: archive-contains-executableThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
Disguised Files: Double Extensions, Fake Icons and Executables Pretending to Be Documents
invoice.pdf.exe, a screensaver with a folder icon, a shortcut that runs PowerShell: Attackers rely on the file looking harmless. The...
Read the guide
8 min read · Updated Sep 14, 2026
Archives and Zip Bombs: Why Compressed Files Need Their Own Scan
Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....
Read the guide