Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
98ccc7d1ce051908…
35.2 KB
POT · lang
a904c86a111f8771…
16.1 KB
PHP · lib/updater
0da4d014f2bfae9e…
13.7 KB
PHP · lib/updater
5cde817d305fee8f…
12.5 KB
PHP · lib/updater
96314baf00439c6e…
10.8 KB
PHP · lib/updater
4ff17a7042829122…
9.8 KB
PHP · lib/updater
5cb0854bcf8317af…
8.5 KB
TXT · lib/updater
076235e130de10f1…
7.3 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.