Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · package root
a4c66807810a73c4…
60.3 KB
JS · video_player_youtube_vimeo/js
a6007e790a20cb45…
41.5 KB
JS · video_player_youtube_vimeo/js
c3302ad5312d2f21…
20.0 KB
CSS · video_player_youtube_vimeo
ed87b4e04b207d92…
8.3 KB
CSS · video_player_youtube_vimeo
b0b792345a442cca…
8.3 KB
PHP · vc_contentadmin
9a5bb12f60888142…
3.8 KB
JS · assets
9c242ba77a21c7e9…
2.7 KB
JS · video_player_youtube_vimeo/js
672e9ffad6591e10…
2.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.