Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
102b2da802da4493…
35.4 KB
FILE · package root
589ed823e9a84c56…
34.3 KB
POT · lang
6de06bf6f9604608…
13.5 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
b273114b0123bd7f…
10.0 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
7cf8ca1de22dc605…
7.9 KB
PHP · lib/updater
267bc22e562cbc12…
7.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.