Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · cmb2
63c2b9a568e2b712…
146.4 KB
TXT · cmb2
f9ae5fdb73b4bc2f…
107.2 KB
MD · cmb2
3c6cafb0de6487e7…
85.3 KB
PHP · package root
fa40181d15116f68…
57.0 KB
POT · package root
97f480fd281e2364…
55.6 KB
PHP · cmb2/includes
2e3c9eceeb751124…
52.8 KB
CSS · cmb2/css
b07930ef3ef9f051…
49.5 KB
CSS · cmb2/css
17eea5d9d975c155…
49.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.