Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · package root
34d2e0b7e0aeecc6…
571.5 KB
PHP · package root
9f5959de94f974cc…
404.4 KB
PHP · package root
ad0abbd6fbdae2c3…
227.1 KB
PHP · package root
ec7c4c779b362a21…
218.4 KB
PHP · Cmn
bb0d45727d884834…
180.6 KB
PHP · package root
d2c361c66a9459da…
141.4 KB
MO · languages
06642dd086495195…
119.1 KB
PHP · Cmn
c415aa899f643965…
116.9 KB
Code signals
7 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization18
gzinflate
Decompresses a string in memory
Obfuscation13
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation9
shell_exec
Runs an operating-system command
System command9
eval (JavaScript)
Executes a string as code
Code execution1
exec / system
Runs an operating-system command
System command1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.