Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · vendor/composer
e0b89566f0dc3b92…
62.2 KB
PHP · vendor/guzzlehttp/psr7/src
299a5bc6f136cdd5…
53.7 KB
MD · vendor/guzzlehttp/psr7
f54bdd5105c07569…
28.8 KB
JS · assets/js
8e3e07c44d375d54…
25.9 KB
PHP · vendor/guzzlehttp/psr7/src
15c7faf0a7edde7b…
21.4 KB
PHP · src/Provider
3a9119965fb121b4…
18.7 KB
PHP · deprecated/vendor
fb16310e33e922e8…
17.4 KB
PHP · vendor/composer
c944c4b1228ef6be…
15.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.