Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
POT · languages
ef7317aedf95f384…
168.2 KB
JS · assets/js/admin
347a31e31f545497…
74.0 KB
PHP · includes/Illuminate
1615d8062b9b5779…
46.5 KB
JS · assets/js
47017ae197591e9b…
44.4 KB
LOCK · license
1264cfe538bf756a…
40.1 KB
PHP · includes/Illuminate/Box
1b61fb270d766100…
34.4 KB
CSS · assets/css
643c7f4114c8bb00…
33.6 KB
PHP · templates/admin
a15619fedbd1e643…
31.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.