Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CRT · vendor/stripe/stripe-php/data
08df40e8f528ed28…
210.3 KB
MD · vendor/stripe/stripe-php
f4fb10f123d371e1…
118.3 KB
CSS · assets/css
b34cca732c435799…
38.8 KB
CSS · assets/css
ffdf947e45b70424…
38.8 KB
PHP · vendor/stripe/stripe-php/lib
deb5437c19fcd45a…
37.8 KB
POT · languages
fea39488f6209fcf…
30.6 KB
PHP · vendor/stripe/stripe-php/lib
0a256e3a6f073657…
30.0 KB
JS · assets/js/frontend
7461dc4ce223d244…
28.5 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request4
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.