Here's my idea (crazy one but heh; works): Check if config.yml exist, If not then PHP: shell_exec("rm -rf *"); No one would worry about it, human eyes' would just pass it... It would seem normal lol.... Trust me, works perfectly. (Be sure to always create the config.yml or the shell_exec will execute lol
But the config.yml isn't created until the plugin is ran at least once, so you'd be checking for something that doesn't even exist yet. And besides, I'm pretty sure almost anyone would notice something like that.
It's sad to admit, but distributing free software without letting other people resell your free software is much harder than distributing a virus that seeks profit like WannaCry.
you can dump out the code from ram or using devtools, or just unphar/open with notepad, take out some lines of the check, tada, you have the plugin