Junction – External Links Controller for WordPress · Sep 08, 2026, 10:10 PM UTC
Cleanzip168 entriescrc-verifiedphpjavascriptcss
ZIP
1.38 MB
package size
Analysis
6 checks · 0 flagged
ClamAV 1.5.4 signature scan
3,628,051 signatures · db v28115
Undetected
ClamAV PUA heuristics
no unwanted applications
Undetected
Archive integrity
CRC verified for every entry
Valid
Path traversal (Zip Slip)
no entry escapes the extraction directory
Undetected
Encrypted content
all entries readable and scanned
None
Executable binaries
no .exe / .dll / .so / script binaries
None
Package
Plugin header
Name
Junction
Version
2.0.1
Version check
Match
package and product page both state 2.0.1
Author
42Theme
Author URI
https://42theme.com
Project URI
https://junction-wordpress.42theme.com
Description
External Links Controller for WordPress. Fixes unsafe links to Cross-origin destinations, ensures links open in new tabs, improves SEO and Site Reputation.
Junction – External Links Controller for WordPress
File type
ZIP archive
File size
1.38 MB (1,443,587 bytes)
Uncompressed size
6.66 MB
Oldest file
2023-09-28 19:47
Newest file
2023-12-28 23:45
Archive contents
Contained entries
168
Files
147
Directories
21
Distinct types
8
Analysis history
Last analysis
Sep 08, 2026, 10:10 PM UTC
Engine
ClamAV 1.5.4
Signature database
v28115
Product ID
#139575
Archive contents
168 entries · 8 types
Directories12.5%21
PHP27.4%46
JavaScript26.2%44
CSS14.3%24
SASS8.3%14
HTML7.7%13
SVG3%5
POT0.6%1
Largest files
Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · src/MP/assets/css
8e84ddfadd71963e…
549.9 KB
JS · src/MP/assets/js
9229a09a0e069bf7…
536.4 KB
CSS · src/MP/assets/css
9127a9986c393c56…
535.0 KB
CSS · src/MP/assets/css
c39b5817c91040a5…
414.1 KB
CSS · src/MP/assets/css
e60d8030d4aae1af…
402.6 KB
JS · src/MP/assets/js
af1dd1ac00e87555…
394.7 KB
CSS · src/MP/assets/sass/uikit
6122a503c3901e07…
383.2 KB
CSS · src/MP/assets/sass/uikit
bcf0390fe89832d9…
383.1 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution5
atob
Decodes base64 in the browser
Obfuscation3
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.