Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · templates
3ef81c6be8eeb864…
1.42 MB
CSS · public/css
ca5454e3c3cfe08e…
746.7 KB
CSS · public/css/demo-css
2fa8760c945b943f…
508.7 KB
JPG · templates/thumbs
9db2f3530e8d5962…
507.1 KB
JPG · templates/thumbs
f907b2dab16723fb…
453.2 KB
SVG · admin/fonts
b821959e441b9fb0…
434.0 KB
JPG · templates/thumbs
ad322cd38c827804…
365.3 KB
JPG · templates/thumbs
203114b1b41bf0d6…
350.9 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request38
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation11
unserialize
Unsafe when given untrusted input
Deserialization3
eval
Executes a string as code
Code execution2
gzinflate
Decompresses a string in memory
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.