Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · includes/post-settings/assets
aae22915f62e4f15…
1.20 MB
PHP · includes/freemius/includes
cb7063cffd6330d5…
997.2 KB
PO · languages
7b11e98e3983400c…
420.6 KB
PO · languages
11d5f5aa92053e5f…
362.4 KB
POT · languages
6e33cc11dcd7d32c…
355.2 KB
JS · includes/freemius/assets/js/pricing
da69c6bfc9e23323…
292.6 KB
JPG · includes/onboarding/assets/img
8b6f744fadeb3168…
232.6 KB
JS · includes/onboarding/assets/dist
05e785b39e37356b…
198.9 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization4
new Function()
Builds a function from a string
Code execution1
gzinflate
Decompresses a string in memory
Obfuscation1
file_get_contents(url)
Fetches a remote URL
Remote request1
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.