Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · vendor/composer
e8ff40b95029c7b7…
65.8 KB
PHP · libraries/GuzzleHttp/Psr7
00a774a483749453…
53.8 KB
PHP · libraries/GuzzleHttp/Handler
bb9955baaf3d18a6…
27.8 KB
PHP · package root
17abce921c165919…
27.5 KB
PHP · libraries/Spatie/Dropbox
39daa1de62c74e6f…
25.1 KB
PHP · libraries/GuzzleHttp/Handler
d2ceffe17914fd17…
21.5 KB
PHP · libraries/GuzzleHttp/Psr7
61f0d322c5d22a63…
21.5 KB
PHP · libraries/GuzzleHttp
6aad12856f456b63…
18.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
shell_exec
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.