Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
01d40df7c31566ce…
328.6 KB
JS · js
52ff41341b9cbc23…
153.0 KB
PHP · package root
f746ac2b880ac9c4…
97.5 KB
PHP · library
c4ef31076307a686…
80.5 KB
PHP · includes
385c9543d395983e…
77.5 KB
PHP · library
88acb1dba939de57…
49.4 KB
PHP · includes
b2c1dbe16d851df1…
44.6 KB
PHP · includes
386e59aee5e2583f…
40.2 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution3
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.