Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
TTF · inc/lib/hfpdf/font
c8cff31fcae0edc0…
305.8 KB
JS · bundles/js
da3254c33f2db7c4…
215.1 KB
POT · languages
f8a56aa27562d120…
160.7 KB
CSS · bundles/css
b53ce42493f13f59…
136.3 KB
DAT · inc/lib/hfpdf/font
212dae6cfd183016…
128.0 KB
JS · inc/assets/js/lib
f81f5fc3bda37008…
100.8 KB
TXT · package root
62b0296a52b5a52c…
93.2 KB
JS · inc/assets/js
69722a3d14f26107…
88.2 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
gzinflate
Decompresses a string in memory
Obfuscation2
unserialize
Unsafe when given untrusted input
Deserialization1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.