Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MMDB · lib/geolite-db
…
2.03 MB
PEM · vendor/composer/ca-bundle/res
1794c1d4f7055b7d…
224.3 KB
PHP · includes
88e911388a6e4a9a…
61.2 KB
JS · assets/js
c1a5095d778e9943…
46.8 KB
JS · assets/js
c1a5095d778e9943…
46.8 KB
PHP · includes/frontend
af6e35d19bf2956a…
37.3 KB
PHP · includes/admin
b5153fc0d3fedb85…
36.7 KB
JS · build
a55a86a71f1093b4…
21.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.