Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
71528af3b487f2a9…
37.5 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
POT · lang
74f06b4439cb03e6…
12.7 KB
PHP · lib/updater
aa0959c659bff20a…
10.4 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
4aa5abadc80be588…
9.3 KB
PHP · lib/updater
926f3a4f82a4986c…
8.0 KB
TXT · lib/updater
0963c398b640ba76…
6.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.