Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
41aefb1e3684656d…
90.4 KB
PNG · images
53c9f67cd9571339…
76.4 KB
PHP · lib/medialibrary
d2d851cf2e3558c7…
30.9 KB
PHP · lib/styleman
eb69ff6aa364adb6…
22.7 KB
PHP · lib/updater
4706707bb1ea58a2…
22.0 KB
TXT · package root
087a8caa47236aa6…
14.8 KB
PHP · package root
8e4e05e6aa711dde…
12.8 KB
POT · lang
ac108c3be966aa41…
11.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization3
Referenced hosts
17 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.