Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · build
0b44f151cbfad7d7…
516.7 KB
JS · build/modules/masking
1fd4d63f53117cc9…
451.4 KB
JS · assets/js
e11c24792eb5ff2d…
317.7 KB
POT · languages
b8e977027ac1b16b…
309.6 KB
JS · assets/js
e59aeea2a52be4c8…
298.4 KB
JS · assets/js
2899e8c35d60c1ff…
200.4 KB
JS · assets/js
ba8edc7e67282664…
157.0 KB
PHP · includes/Config
22d6d005b45160e8…
119.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.