Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages
eda765957bac92f8…
56.7 KB
POT · lang
4546a8fd35c9e335…
48.3 KB
PO · languages
a653e2398132abbe…
45.8 KB
PHP · lib/updater
f30b509c63f3c0f1…
35.1 KB
FILE · package root
589ed823e9a84c56…
34.3 KB
POT · languages
f8dbd8974796c50f…
32.4 KB
PHP · includes/groups
c4933345b406f592…
31.0 KB
PHP · includes
d34e693f77fe4c1a…
15.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.