Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · admin/assets/inc/select2/dist/js
ba0664111e4e0041…
169.5 KB
JS · admin/assets/inc/select2/dist/js
46716cb20114cd73…
150.0 KB
JS · public/assets/js/momentjs
a357a289ec8971e4…
127.8 KB
PHP · admin/view
8ac58ee102746724…
115.3 KB
PHP · public/inc/mobile-detect
7784f90452f4a43d…
79.1 KB
JS · admin/assets/inc/select2/dist/js
5c6fdab80cb86a27…
77.4 KB
JS · admin/assets/inc/select2/dist/js
c8467b98f112bb1b…
69.2 KB
PO · lang
b30c7eaa18896349…
53.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.