Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · js/built
3a49a4890155fa78…
56.0 KB
MAP · js/built
fd7238044c613675…
43.5 KB
PHP · package root
f16ee0e4becb6168…
26.9 KB
TXT · vendor/automattic/jetpack-autoloader
e5d670958f34eae7…
18.0 KB
CSS · assets/css
58bd7ac3b1a9fa9d…
17.3 KB
PHP · vendor/composer
1e4525198301d1ed…
17.0 KB
MD · vendor/automattic/jetpack-autoloader
b093f15f449b7541…
16.4 KB
PHP · vendor/composer
d4b2313e562edf94…
16.0 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.