Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
DAT · com/libs/SxGeo
aa656c5f1efe24fa…
387.4 KB
PHP · com/libs/vendor/beberlei/assert/lib/Assert
a0d6d3739fe91357…
108.6 KB
JPG · public/img
f83a81e941327bbf…
85.0 KB
MD · com/libs/vendor/guzzlehttp/guzzle
83d72d4f53b06a1a…
73.0 KB
LOCK · com/libs/vendor/fgrosse/phpasn1
232912d6eb7036a2…
49.6 KB
MD · com/libs/vendor/guzzlehttp/guzzle
fbece1bd933d0147…
49.6 KB
LST · com/libs/vendor/mdanter/ecc/tests/data
a9020cb2f09b2364…
38.4 KB
JSON · com/libs/vendor/composer
749a8e4ab40260eb…
29.1 KB
Code signals
7 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation18
assert
Can execute a string as code on old PHP
Code execution11
curl_exec
Makes an outbound HTTP request
Remote request4
gzinflate
Decompresses a string in memory
Obfuscation3
eval (JavaScript)
Executes a string as code
Code execution2
shell_exec
Runs an operating-system command
System command2
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.