Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · package root
acb4f38d65971a24…
119.8 KB
MP3 · notification-sound
c674ec41f1f2975d…
55.5 KB
MP3 · notification-sound
b4882e3941ca496b…
50.6 KB
MP3 · notification-sound
421705f782270562…
35.2 KB
MP3 · notification-sound
d1fb532c05e45120…
26.9 KB
JS · js
78422d243ff84d1f…
19.0 KB
PHP · package root
16b2c9a742d701c4…
16.3 KB
MP3 · notification-sound
7046a5bc442475e1…
14.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization5
Referenced hosts
3 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.