Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
c31f366c8aa51d5b…
34.8 KB
PHP · includes/libraries
f1cd8077a7f6ece3…
25.4 KB
POT · lang
fabe886fdcbb212b…
16.3 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · lib/updater
031290dcf0add90a…
9.9 KB
PHP · lib/updater
b84d04c765e72638…
9.8 KB
PHP · includes/admin/settings
ba39c5958fd2d54e…
7.8 KB
PHP · lib/updater
4befb1d8005ddfc7…
7.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.