Popup Plugin for WordPress – Green Popups (formerly Layered Popups)
File type
ZIP archive
File size
6.47 MB (6,786,076 bytes)
Uncompressed size
16.84 MB
Oldest file
2026-10-30 16:25
Newest file
2026-10-30 16:25
Archive contents
Contained entries
866
Files
790
Directories
76
Distinct types
22
Analysis history
Last analysis
Oct 30, 2026, 06:10 PM UTC
Engine
ClamAV 1.5.4
Signature database
v28115
Product ID
#199809
Archive contents
866 entries · 22 types
Directories8.8%76
PHP69.9%605
PNG4.5%39
CSS4.2%36
JavaScript2.1%18
Text2%17
HTML1.2%10
JPEG0.9%8
No Ext0.9%8
Z0.9%8
SVG0.7%6
WOFF0.7%6
WOFF20.7%6
TTF0.7%6
EOT0.7%6
Markdown0.6%5
JSON0.1%1
XML0.1%1
GIF0.1%1
CONF0.1%1
CRT0.1%1
ICC0.1%1
Largest files
Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · libs/tcpdf
2f7a77d9c00573d9…
884.7 KB
SVG · fonts
dab1672cb40e5e63…
796.9 KB
Z · libs/tcpdf/fonts
4c4960e1d89c6638…
788.8 KB
PHP · package root
1c7909ce08a5b946…
721.5 KB
SVG · fonts
2708846a27993760…
644.4 KB
JS · js
107bff860457c633…
550.6 KB
Z · libs/tcpdf/fonts
c41875574b59425f…
414.5 KB
PHP · package root
00bc0c5d7ce90917…
398.6 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation216
curl_exec
Makes an outbound HTTP request
Remote request100
unserialize
Unsafe when given untrusted input
Deserialization23
gzinflate
Decompresses a string in memory
Obfuscation3
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.