Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · src/assets/dist/backend
b880b1b4d1f3c954…
277.6 KB
MAP · src/assets/dist/frontend
d0f803db89f30852…
120.7 KB
POT · languages
63050e2799841c77…
108.4 KB
JS · src/assets/legacy/frontend/js
eeb2dc53978c71e2…
87.3 KB
PO · languages
0e8f115b32293545…
77.9 KB
MAP · src/assets/dist/frontend
4b0e30d47546c13b…
75.9 KB
JS · src/assets/dist/backend
895ba256e6ea645c…
71.0 KB
PHP · src/classes
9e613ff04e6dfbec…
65.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.