Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MD · vendor/guzzlehttp/guzzle
d53583d37ca3a804…
86.7 KB
PHP · vendor/guzzlehttp/psr7/src
b344b4dfe13992b8…
55.0 KB
MD · vendor/guzzlehttp/guzzle
f1c542dabec21ba4…
53.6 KB
JSON · vendor/composer
b395576b9f126ac9…
32.4 KB
PNG · assets/images
ef7857b8578674ca…
30.9 KB
MD · vendor/guzzlehttp/psr7
8ad04a284101d22d…
29.5 KB
PHP · vendor/league/oauth2-client/src/Provider
8d007855933a7e90…
26.9 KB
PHP · vendor/guzzlehttp/guzzle/src/Handler
f0f5b7b365036812…
24.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.