Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · dist/js
56d5c96d813413c9…
1.65 MB
PHP · vendor/freemius/includes
cb7063cffd6330d5…
997.2 KB
CSS · dist/css
748b9971e9ffbb46…
843.0 KB
CSS · dist/css
4b94a649610ddba7…
408.6 KB
JS · vendor/freemius/assets/js/pricing
da69c6bfc9e23323…
292.6 KB
CSS · dist/css
05fa54d7603dc4b2…
233.3 KB
PHP · classes/chatbot
702aff920cc8c358…
199.3 KB
PHP · classes/content-writer
30dc26f20ec8a118…
193.0 KB
Code signals
7 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation27
gzinflate
Decompresses a string in memory
Obfuscation3
curl_exec
Makes an outbound HTTP request
Remote request2
unserialize
Unsafe when given untrusted input
Deserialization2
new Function()
Builds a function from a string
Code execution2
atob
Decodes base64 in the browser
Obfuscation1
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.