Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PDF · package root
c5e74f064b6b51ef…
85.9 KB
PHP · package root
3c9e53ee0a2858be…
66.3 KB
JS · assets/js
841435764267e953…
17.4 KB
JS · assets/js
4532207bafec68ba…
11.5 KB
JS · assets/js
44f95961429ab546…
11.3 KB
JS · assets/js
8421714893e24732…
8.5 KB
CSS · assets/css
027fc33cfc2ab839…
6.3 KB
PHP · templates
f15d5a8f82e43cbc…
6.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
3 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.