Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages/admin-language-files
0062b9abbaee1d03…
272.4 KB
PO · languages/admin-language-files
0769dedd9878bd3a…
265.6 KB
PO · languages/admin-language-files
3b64c64646d5bf61…
237.2 KB
PO · languages/admin-language-files
9be9e9d83e499f6d…
235.0 KB
PO · languages/admin-language-files
807524454c18b014…
234.3 KB
PO · languages/admin-language-files
5ee91e47ab5085ce…
232.0 KB
PO · languages/admin-language-files
2d7a1d46e2e2fe1b…
228.1 KB
PO · languages/admin-language-files
59da28cfc6f6eb8f…
228.1 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.