Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · vendor_prefixed/mpdf/mpdf/src
e05c51f95ec7f33c…
1.19 MB
TTF · assets/fonts
08ca98e69d9d8fa1…
724.2 KB
TTF · assets/fonts
7e69e81478e233b8…
677.6 KB
TTF · assets/fonts
0603149f330f53c6…
617.6 KB
TTF · assets/fonts
440d2978d12b3bc2…
617.4 KB
PHP · vendor_prefixed/mpdf/mpdf/src
5f1d5bcdd8a44a97…
320.1 KB
PHP · vendor_prefixed/mpdf/mpdf/src
2687202191aa04d4…
219.3 KB
PHP · vendor_prefixed/mpdf/mpdf/src
1348d0c0ca9385cd…
205.5 KB
Code signals
7 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization6
gzinflate
Decompresses a string in memory
Obfuscation5
shell_exec
Runs an operating-system command
System command3
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
curl_exec
Makes an outbound HTTP request
Remote request2
assert
Can execute a string as code on old PHP
Code execution1
create_function
Removed in PHP 8; builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.