Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
POT · languages
fc3a67944baf42c8…
453.4 KB
PNG · includes/core/assets/images/about
218ecb5d6ea3b376…
348.9 KB
JS · includes/core/assets/js/dist
1907b0809d08e20d…
252.6 KB
JS · includes/pro/assets/js/vendor/intlTelInput
0399719be23112b9…
247.1 KB
JS · includes/core/assets/js/dist
6ffc069638f4bcb6…
225.7 KB
CRT · lib/Stripe/data
08df40e8f528ed28…
210.3 KB
PNG · includes/pro/assets/img/vendor
8ab4e961a71e2a40…
170.3 KB
MD · lib/Stripe
acd23f5e45cee626…
120.4 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request2
unserialize
Unsafe when given untrusted input
Deserialization2
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.