Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages
a5ce1f8ee4520537…
211.2 KB
PO · languages
ee2cd0eee7d0ddae…
188.7 KB
PO · languages
46fada2405d2e2b6…
188.2 KB
PO · languages
84e02e198ee9da17…
187.2 KB
PO · languages
1d48dd65581af80b…
187.2 KB
PO · languages
91ecff709a525914…
186.3 KB
PO · languages
1a33e3cc1d0e5434…
184.3 KB
PO · languages
b619e14fdfbbd421…
183.1 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.