Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · i18n/languages
ea9cad77c00431ac…
96.6 KB
PHP · views/admin/import/options
ed071bde4d3c2f08…
83.2 KB
PO · i18n/languages
b1272ef66ac3d836…
82.8 KB
PO · i18n/languages
e80d0f9dc6e2377d…
82.5 KB
PHP · views/admin/import/product/_tabs
24b03135a15f981f…
72.8 KB
POT · i18n/languages
cddc1c66b3a4dd52…
71.5 KB
MO · i18n/languages
7873c429d2e090a5…
50.7 KB
MO · i18n/languages
4f220bc8c1b37bdb…
43.2 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
create_function
Removed in PHP 8; builds a function from a string
Code execution1
Referenced hosts
8 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.