Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CRT · lib/oauth/certs
89727441dfb78eb3…
245.5 KB
PHP · package root
a98e19d3bd045719…
35.8 KB
TXT · package root
6c17278a7a134a73…
35.0 KB
PHP · lib/oauth/lib
0f592b37bfa04d17…
21.2 KB
PHP · lib/oauth/lib
692b1e6ef331ebf3…
17.8 KB
PHP · lib/oauth/tests
6f65c6ca4b14ff2e…
17.3 KB
GIF · assets/art
37cef6a3c567c9ce…
9.2 KB
MD · lib/oauth
227b806dc7c1333c…
6.2 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
curl_exec
Makes an outbound HTTP request
Remote request1
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.