Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
TTF · vendor/endroid/qr-code/assets
e64e508b2aa2880f…
212.3 KB
PHP · vendor/bacon/bacon-qr-code/src/Encoder
c9e3cc113c275bb5…
22.0 KB
PHP · vendor/bacon/bacon-qr-code/src/Common
a3c97701f474a454…
21.4 KB
PHP · vendor/bacon/bacon-qr-code/src/Encoder
c5764dd1f44a57b9…
16.5 KB
PHP · includes/actions
b02a83ea0ee977fc…
16.0 KB
PHP · vendor/composer
d4b2313e562edf94…
16.0 KB
PHP · vendor/composer
21f4ba19e7859cb3…
15.8 KB
PHP · vendor/bacon/bacon-qr-code/src/Common
779785ad583b98b8…
14.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
18 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.