Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · package root
5e9a1a6ab1758e7f…
143.4 KB
PHP · lib/updater
1c50c5034684b937…
36.7 KB
POT · lang
70c5306cfb70d959…
13.7 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
dcabc8ca80aafe98…
10.4 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
49baf06cb43650ca…
9.3 KB
PHP · lib/updater
f33a2b81255eeb1a…
8.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.