Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · admin/files/js
8063b089925a9f2e…
637.6 KB
JS · admin/files/js
940345f3a8a3dd03…
452.0 KB
SVG · admin/files/fonts
fc378232f9dad500…
436.6 KB
JPG · assets/images
6a4cc3e64cd9e1c6…
412.7 KB
SVG · admin/files/fonts
dd1d74abcb411c1c…
328.2 KB
SVG · admin/files/css/font-awesome/fonts
beed91f60f61e115…
306.6 KB
JS · admin/files/js
483390de0b0a35bb…
232.7 KB
CRT · admin/files/lib/data
9265af106c80ad5f…
222.2 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request4
unserialize
Unsafe when given untrusted input
Deserialization2
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.