Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes/libraries/scssphp/src
77a65ae9ba3f6cec…
231.4 KB
PHP · includes/libraries/scssphp/src
6bf7d398e064908a…
90.7 KB
JS · assets/js/admin
f789a2afe868ed2b…
74.4 KB
PHP · includes
05c762e802630c66…
62.6 KB
POT · languages
9f147b4486de498e…
48.4 KB
JS · assets/js/admin
3f6d9c8d95fe3641…
38.5 KB
PHP · includes/views
8ddf127954ccc6b7…
35.7 KB
PHP · includes
1745a75c00560ee4…
29.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
17 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.