Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
6c9a878551b0f2e7…
35.1 KB
POT · lang
5dd73e72165ced96…
16.4 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
67292418b653acd3…
9.9 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · includes/admin/settings
ff9fa7963df468e0…
9.8 KB
PHP · lib/updater
20fd6a41ea2288d2…
7.9 KB
PHP · lib/updater
b57cea41ed0e7b7c…
7.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.