Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · images
453cfa21e5693429…
982.4 KB
JPG · images
b27b8400ad0fb795…
924.0 KB
PNG · images
d7059972b54787b4…
730.0 KB
PNG · images
f892331dd87f1e9d…
621.4 KB
PNG · images
715511928a7276a4…
602.7 KB
PNG · images
bc01674947371a55…
597.9 KB
PNG · images
e558cf176f5f6137…
597.3 KB
PNG · images
6ab9ec69618244d4…
576.2 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.