Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · language
de3b9dd61ea68cb8…
80.2 KB
PO · language
360873d366ec6196…
78.5 KB
JSON · vendor/composer
b88498cf29502dd0…
77.6 KB
PO · language
d139cf5145167760…
73.0 KB
PO · language
0780ed5519d7dd85…
72.1 KB
PO · language
69b36790f1f2e9ee…
69.4 KB
POT · language
29e3059667b55c9d…
63.5 KB
PHP · app/Services/Integrations/Calendars/Google
cdd2ba195c544be2…
36.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation4
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.