Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · vendor/square/square/src/Apis
0038ed83e5f92092…
133.5 KB
MD · vendor/square/square/doc
63c162900625cfc6…
59.5 KB
PHP · vendor/square/square/src/Apis
58e47ac197b6717b…
55.4 KB
PHP · vendor/square/square/src/Apis
ff25ed1b520ea43c…
41.2 KB
PHP · vendor/square/square/src/Apis
06347b1aa3d4e53b…
40.9 KB
PHP · vendor/square/square/src/Apis
7e9c92730531baac…
40.5 KB
PHP · vendor/square/square/src/Apis
da989fed93a019da…
40.3 KB
PHP · vendor/apimatic/jsonmapper/tests
35bf0c79567536b9…
39.0 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
exec / system
Runs an operating-system command
System command4
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
file_get_contents(url)
Fetches a remote URL
Remote request1
eval
Executes a string as code
Code execution1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.