Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · app
515a7a9cc38ab616…
1.22 MB
JS · premium
51a2fd1ea47f1a9b…
1.19 MB
JS · app
a6643dc5cbd7e408…
536.7 KB
JS · app
411d9851868f8c78…
402.2 KB
JS · app
e4d85bf8e1c3ef36…
315.4 KB
PHP · premium
8b96a21939f50537…
180.8 KB
JS · app
94359af33ae818db…
166.1 KB
JS · premium
cf08e8a22a1b596f…
141.0 KB
Code signals
8 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation12
new Function()
Builds a function from a string
Code execution7
eval (JavaScript)
Executes a string as code
Code execution6
atob
Decodes base64 in the browser
Obfuscation4
unserialize
Unsafe when given untrusted input
Deserialization4
curl_exec
Makes an outbound HTTP request
Remote request3
exec / system
Runs an operating-system command
System command2
assert
Can execute a string as code on old PHP
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.