Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · inc
59e525617501e5cf…
126.6 KB
JS · assets/js
bd97c504358991e2…
101.4 KB
POT · languages
4de766e973859e74…
72.6 KB
PHP · inc
564e75f45acf8008…
44.3 KB
PHP · inc/admin/menu/tabs
fd71dbe71c3ca8c9…
29.7 KB
PHP · inc/admin
3ffee8451d4c68ba…
26.8 KB
PHP · inc/compatibility
9fc2396650e8ea4c…
25.9 KB
PHP · inc/admin/menu/tabs
b9377f4c0c6c0a80…
24.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.