Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
ade16e27613523a7…
10.4 KB
PHP · package root
c1c6237c8ad85cf5…
10.4 KB
CSS · css
200e67aa65e5e2fc…
5.7 KB
PHP · package root
e8b3d25b0a471c2d…
5.0 KB
TXT · package root
eed01f928d56254d…
3.0 KB
POT · lang
26f68ec5f708b261…
2.4 KB
PNG · images
522c8d51a12c7a68…
1.8 KB
PNG · images
786d79dffb95d859…
1.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
5 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.