Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · acf/lang
b12efc5587f95f28…
307.6 KB
JS · package root
667eedae1808b6d3…
287.6 KB
PO · acf/lang
801a2368c5917a5f…
281.7 KB
PO · acf/lang
d0253fb8b6f1c8f1…
281.7 KB
PO · acf/lang
84bcb84c70fef14d…
274.9 KB
PO · acf/lang
2a73a9d9c3e1f6c2…
270.0 KB
PO · acf/lang
3e8c78f15564de21…
269.2 KB
PO · acf/lang
5e0d028f9aa96ace…
266.6 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization6
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation5
eval (JavaScript)
Executes a string as code
Code execution2
gzinflate
Decompresses a string in memory
Obfuscation2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.