Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
DAT · lib/jpgraph/src
4b5778eabf3e962c…
959.6 KB
DAT · lib/jpgraph/src
99395f52cc2cb18d…
671.4 KB
TTF · lib/jpgraph/src/fonts
8c35bb933dcc3acd…
667.5 KB
TTF · lib/jpgraph/src/fonts
ab6ad52307cbb35d…
619.3 KB
TTF · lib/jpgraph/src/fonts
28d7dcf59e863cd7…
561.2 KB
TTF · lib/jpgraph/src/fonts
bf9abc490ef93235…
561.0 KB
DAT · lib/jpgraph/src
db900780b913a537…
366.7 KB
DAT · lib/jpgraph/src
a3ea7736b9e29265…
209.3 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation8
assert
Can execute a string as code on old PHP
Code execution7
unserialize
Unsafe when given untrusted input
Deserialization1
eval
Executes a string as code
Code execution1
Referenced hosts
15 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.