Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · bp-core/js/vendor
4cc8e00f9c76b046…
1.97 MB
PO · languages
cc24f9ee5f3cfa8a…
1.43 MB
POT · languages
61a37dab7a4a4bb3…
1.30 MB
PO · languages
5889cfd8fa251176…
1.26 MB
PO · languages
9f924a5c439b173d…
1.24 MB
PO · languages
48de750d03ce5661…
1.09 MB
CSS · bp-templates/bp-nouveau/css
b3bc48d3649f034c…
943.3 KB
CSS · bp-templates/bp-nouveau/css
d43977aa50da1d24…
943.2 KB
Code signals
9 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation32
exec / system
Runs an operating-system command
System command14
shell_exec
Runs an operating-system command
System command13
unserialize
Unsafe when given untrusted input
Deserialization12
atob
Decodes base64 in the browser
Obfuscation7
assert
Can execute a string as code on old PHP
Code execution5
eval
Executes a string as code
Code execution3
new Function()
Builds a function from a string
Code execution1
gzinflate
Decompresses a string in memory
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.