Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js
1fcce2b5b26d939e…
39.8 KB
TXT · package root
9e1e5c76e35fb51d…
32.5 KB
PO · languages
2e6e3dc75685f807…
22.0 KB
POT · languages
795749e27f85ce50…
18.4 KB
PHP · includes/controls
ffb53048532b3b69…
12.9 KB
MO · languages
4014c8eb9007c6a8…
9.9 KB
PHP · includes/controls
5fefbbb80e3e7c11…
9.2 KB
PHP · includes/controls
93bc71dfe94f6b66…
8.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.