Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PEM · vendor/composer/ca-bundle/res
ae31ecb3c6e9ff31…
203.2 KB
LOCK · vendor/abraham/twitteroauth
3e37a3a74e4c8342…
128.7 KB
PHP · vendor/abraham/twitteroauth/src
25d9d5fc72938c04…
20.6 KB
PHP · vendor/composer/ca-bundle/src
1c1ce9380893b86b…
17.2 KB
PHP · vendor/composer
c944c4b1228ef6be…
15.7 KB
PHP · vendor/abraham/twitteroauth/vendor/composer
1f8c29cdfa3029f4…
15.7 KB
PHP · vendor/composer
e8942a092540ae85…
13.7 KB
PHP · classes
4c0b9e8b862f9937…
10.4 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.