Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · package root
c03b472c3c01b208…
691.1 KB
SVG · fonts
2180ca12d19b96ae…
434.0 KB
PNG · images
225e7464ba5cf005…
218.5 KB
PNG · images
46a57ad1fc5ccc4b…
201.5 KB
PHP · functions
47f1866270cb90ac…
188.9 KB
PNG · images
5e7dd141082cc280…
185.9 KB
PNG · images
16eb82c8019f55ee…
185.8 KB
PNG · images
dc79a783562d27ec…
162.1 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization9
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.