Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes/classes
3140edd852b28460…
74.6 KB
TXT · package root
8ceb4b9ee5adedde…
34.3 KB
PHP · includes/third-party
c012064800d201cb…
33.1 KB
PHP · includes/third-party
39bee4e21382f2f1…
22.8 KB
PHP · includes/third-party
64780f005c0c4527…
21.7 KB
PHP · includes/third-party
5d4c0162621e1f1c…
20.0 KB
PHP · includes/third-party
7c6fbb00b61122e8…
17.9 KB
PHP · includes/third-party
541b32d06b1dd411…
15.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
2 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.