Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · themes/Timber
9443c7f00198941b…
98.0 KB
JS · js
41aefb1e3684656d…
90.4 KB
PNG · themes/Starter-CMS
7648ab2f8c8ae0dd…
87.7 KB
PNG · images
53c9f67cd9571339…
76.4 KB
JPG · themes/Timber/images
cf7b2c0775f8c32e…
64.9 KB
PHP · classes
0e9dbf46d25163f4…
63.9 KB
JPG · themes/Banner/images
650e79af3a2ce05e…
61.7 KB
JS · themes/Starter-CMS/js
d548530775a6286f…
54.5 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution9
exec / system
Runs an operating-system command
System command4
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.