Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · classes
13f547b846516dcb…
28.1 KB
PHP · classes
b891228bd83bc4bd…
21.6 KB
FILE · vendor/composer
0f0a56ec4b646b3b…
19.7 KB
PHP · vendor/composer
ba40c4e0b003d817…
12.2 KB
PHP · includes/Product
b53ad9fd5db44cd4…
6.9 KB
PHP · classes/importer
904b1eaf85424957…
6.7 KB
PHP · vendor/composer
c3ebbae193d160eb…
6.1 KB
PHP · package root
886abed28b65579d…
5.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.