Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
c76250fec437c1c2…
34.1 KB
PHP · Legacy
401457635ab0ff78…
18.0 KB
PHP · composer
d4b2313e562edf94…
16.0 KB
PHP · composer
21f4ba19e7859cb3…
15.8 KB
PHP · Gateways
de85901b61dcf3ef…
8.9 KB
POT · package root
40a194bf18dd6fec…
8.7 KB
PHP · Gateways
c385c8de0dc0dd19…
8.5 KB
PHP · Recurring
a56aeb5255f26cd3…
7.7 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution26
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.