Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · vendors/acf/lang
b12efc5587f95f28…
307.6 KB
PO · vendors/acf/lang
801a2368c5917a5f…
281.7 KB
PO · vendors/acf/lang
d0253fb8b6f1c8f1…
281.7 KB
PO · vendors/acf/lang
84bcb84c70fef14d…
274.9 KB
CSS · assets/vendors/woo-setup-wiz/css
16b05c5f947da7a7…
273.5 KB
CSS · assets/vendors/woo-setup-wiz/css
c71618890d9ec00e…
273.4 KB
PO · vendors/acf/lang
2a73a9d9c3e1f6c2…
270.0 KB
PO · vendors/acf/lang
3e8c78f15564de21…
269.2 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
eval (JavaScript)
Executes a string as code
Code execution2
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.