Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
XML · package root
d5bfa577b2eb5805…
1.32 MB
PNG · img/faq
665a7e3c5cea0743…
1.21 MB
TTF · fonts
2ebd93ea67141b23…
976.3 KB
TTF · fonts
87a056d8c3a7ab18…
870.7 KB
TTF · fonts
229b67ef16372975…
767.5 KB
EOT · fonts
8a6cde2bd53ff29f…
477.8 KB
CSS · css
87d82efdf0fda046…
454.7 KB
EOT · fonts
dba634574c563f1e…
439.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.