Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · images
d813e790a7f842a4…
589.3 KB
JS · framework/core/inc/fields/ace_editor/vendor
a298c47c9b4cfd3d…
332.8 KB
JS · framework/core/inc/fields/ace_editor/vendor
7fda71b6999f2afd…
210.5 KB
JS · framework/core/assets/js/vendor/qtip
3d245ef65186ad14…
184.7 KB
PHP · framework/core
a9884e4ae8a82dfb…
182.7 KB
JS · framework/core/inc/fields/ace_editor/vendor
9c2f87e6674c8b0f…
163.3 KB
CSS · framework/core/assets/css
6f36eea4565c19d6…
150.7 KB
JS · framework/core/assets/js/vendor/select2
ccb44d674d0d7bce…
148.5 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
create_function
Removed in PHP 8; builds a function from a string
Code execution1
new Function()
Builds a function from a string
Code execution1
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.