Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
8deb2de86b9f4348…
34.2 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
POT · lang
414baa9f4503f56c…
13.4 KB
PHP · package root
164acbd03f1092f9…
12.8 KB
PHP · lib/updater
8cf63e4cc5bd85c3…
9.8 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · lib/updater
5581453270668bb6…
7.8 KB
PHP · lib/updater
5b6242483626b5ed…
7.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.