Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
FILE · package root
8ceb4b9ee5adedde…
34.3 KB
TXT · package root
c1b685f3b994302c…
33.4 KB
PHP · src/plugins
1e6efe209fdfd934…
29.0 KB
PHP · src
825ea5798e78dde3…
25.6 KB
PHP · src
d000886a7b18b710…
24.9 KB
PHP · dependencies/wpsyntex/updater/src
8a76170b47dfd3bf…
21.6 KB
PHP · src
e8709b763070301f…
20.9 KB
PHP · vendor/composer
1e4525198301d1ed…
17.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.