Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
10d1a882cdad7c9d…
34.8 KB
POT · lang
2e167139e2997d04…
15.3 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
bd343bc7de5f19c7…
9.9 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · includes
14c7f740beb458d6…
9.1 KB
PHP · lib/updater
877ef13c1e8283a2…
7.8 KB
PHP · lib/updater
c25252df8890963b…
7.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.