Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · assets/img
b9705f0a7b2d617b…
38.4 KB
JS · assets/js
86213035ccac316b…
28.0 KB
PHP · includes
7dc698142237401d…
26.1 KB
PHP · includes
ae70814a22bf1d58…
25.5 KB
PHP · package root
ffe36a21896d385d…
23.2 KB
PHP · includes
5a7857a59c852314…
22.9 KB
JS · assets/js
11ffc0301a8f73b1…
17.2 KB
PHP · includes/admin
144f1d75ab1327e6…
14.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization4
Referenced hosts
1 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.