Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
3354be1e7451201b…
36.6 KB
POT · lang
6fb5c875e2884779…
14.0 KB
PHP · package root
0db5208a2693c535…
13.8 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
5ffcb47e78fd7344…
10.4 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
09a27b0d653c32f3…
9.3 KB
PHP · lib/updater
bb4298ab57b08a50…
8.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.