Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · img
f23d093c5b15ed3a…
147.1 KB
PHP · plugin-update-checker/vendor
426aa1d5948986f1…
36.7 KB
PHP · plugin-update-checker/vendor
b6538399a732ea15…
36.4 KB
PHP · plugin-update-checker/Puc/v4p11
93b2ee1344bf97fc…
30.7 KB
PHP · package root
c419b175979bd7bd…
25.8 KB
PNG · img
e4024671f7f5a16a…
18.7 KB
PNG · img
75e93ca530f12885…
18.3 KB
POT · package root
0628883b01983a6c…
16.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.