Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
FILE · package root
8ceb4b9ee5adedde…
34.3 KB
TXT · package root
826865fd07ebcb2a…
33.0 KB
PHP · src/plugins
1e6efe209fdfd934…
29.0 KB
PHP · src
825ea5798e78dde3…
25.6 KB
PHP · src
49c9daa1ba57df01…
24.5 KB
PHP · dependencies/wpsyntex/updater/src
8a76170b47dfd3bf…
21.6 KB
PHP · src
e8709b763070301f…
20.9 KB
PHP · vendor/composer
1e4525198301d1ed…
17.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.