Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
09da06cfef0fede5…
37.0 KB
POT · lang
6a7563ea64f8e174…
19.0 KB
PHP · includes
e3c2e200bdd64458…
18.3 KB
PHP · includes
d5469bb0552053a4…
17.4 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · includes
5903e8a3c648c202…
10.9 KB
PHP · lib/updater
436dd9af95dee9f4…
10.4 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.