Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · package root
406a9b8cb3f7548e…
1.43 MB
PO · languages
61499ac17a04aef3…
499.8 KB
MO · languages
0a49a0622488c2d0…
333.5 KB
PHP · languages
7664afee27301b42…
310.5 KB
POT · languages
c28304be6ddaf352…
287.2 KB
PHP · package root
8ff714db83d775ef…
245.7 KB
PHP · inc
6338c14d6beb13a1…
244.6 KB
PHP · package root
d347da6d8e6e897b…
126.0 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request5
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation5
unserialize
Unsafe when given untrusted input
Deserialization3
new Function()
Builds a function from a string
Code execution2
gzinflate
Decompresses a string in memory
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.