Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
FILE · vendor/composer
0f0a56ec4b646b3b…
19.7 KB
PHP · vendor/composer
ba40c4e0b003d817…
12.2 KB
PHP · classes
8374f2bf84876020…
8.3 KB
PHP · includes/Product
6f89e3e9f5b25fc8…
6.8 KB
PHP · vendor/composer
c3ebbae193d160eb…
6.1 KB
PHP · includes/PROInstall
6d812f751bcbb5ee…
5.3 KB
PHP · package root
42ae7d24737a83ac…
4.6 KB
PHP · includes
90569ce1b2d2e2a7…
4.3 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
6 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.