Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · pluginbuddy
72d39f5d757c76a8…
50.7 KB
PHP · lib/medialibrary
1588f33e1be3e0e8…
30.9 KB
PHP · pluginbuddy/classes
b76b30e33f506de9…
22.8 KB
PHP · lib/updater
b6b92a71c92ee338…
21.6 KB
JS · js
15e6fae7f7822272…
18.1 KB
PHP · pluginbuddy/classes
239b9c2e9d4e1f72…
15.1 KB
TXT · package root
087a8caa47236aa6…
14.8 KB
PHP · pluginbuddy/classes
5b333fdad8e8795e…
13.8 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
create_function
Removed in PHP 8; builds a function from a string
Code execution5
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
18 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.