Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · classes/Framework/Dashboard/js/assets
…
7.27 MB
WOFF2 · assets/fonts
e564f652916db6c1…
378.9 KB
WOFF2 · assets/fonts
693b77d4f32ee9b8…
344.0 KB
PHP · library/ScssPhp
c4c901073ab2ad55…
307.4 KB
SCSS · assets/scss
e3f87161774af33e…
261.9 KB
JSON · config/ui
c3e7f58e9e36e253…
203.9 KB
JS · classes/Features/Bem_Class_Generator/js
94a0443f393a86d6…
122.1 KB
PHP · library/ScssPhp
efa06a190a656a8f…
112.8 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
assert
Can execute a string as code on old PHP
Code execution65
unserialize
Unsafe when given untrusted input
Deserialization2
new Function()
Builds a function from a string
Code execution1
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.