Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
2d705fd10cd6b681…
35.0 KB
PHP · settings
cb07a7f9e0b94cbd…
17.4 KB
POT · lang
e5574895bd467be3…
15.1 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
d18943c2a79dbe15…
9.9 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
4097d490e3030e7b…
7.8 KB
PHP · lib/updater
ffe177c3d1ed30a7…
7.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.