Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · app/Modules/CloudStorage/S3
a6de1d49682d740c…
75.3 KB
PHP · app/Services
a98d875932b9d5d5…
61.2 KB
PHP · app/Services
0a0c8672cdb50af6…
57.3 KB
PHP · app/Services
b164bce4b57cc7b1…
51.8 KB
PHP · app/Services
33025d5eb45477c9…
28.6 KB
PHP · app/Hooks/Handlers
ff82a4048c91ad03…
25.8 KB
PHP · app/Http/Controllers
e645e31039af3b3a…
24.8 KB
PHP · app/Hooks/Handlers
5cbc3c02f3dd8767…
24.5 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
unserialize
Unsafe when given untrusted input
Deserialization2
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.