Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
XML · admin/importer/demo-files
14ca2aebcb3f8e69…
1.01 MB
TTF · assets/fontawesome/webfonts
b4990d0d0c5f5d38…
410.5 KB
PNG · package root
bc00d8f50be3b92c…
322.5 KB
TTF · assets/fontawesome/webfonts
e28096fa75a96ac7…
204.2 KB
WOFF2 · assets/fontawesome/webfonts
ae17c16afbea2167…
152.7 KB
JS · assets/js
0de8a4d7ce50be6f…
150.0 KB
CSS · assets/fontawesome/css
2d0ea9247b2dfce7…
138.0 KB
PHP · lib
5052c0a837853956…
128.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.