Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes/libraries/scssphp/src
ec6276890ea88c60…
305.8 KB
PHP · includes/libraries/scssphp/src
9f9cf5b3bb6d3269…
112.1 KB
JS · assets/js/admin
ed673b5d3534a291…
107.1 KB
POT · languages
c6fdff097eb22952…
57.4 KB
JS · assets/js/admin
cf50d054276a601b…
53.8 KB
PHP · includes
7aded64cecc6127c…
34.0 KB
PHP · includes/views
7fbaab33eb332874…
29.6 KB
JS · assets/js/admin
361ed59cd67cf97b…
23.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
assert
Can execute a string as code on old PHP
Code execution64
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
17 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.