Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · assets
829e396acceec502…
50.9 KB
PHP · includes
f5579db64f25bd02…
40.0 KB
TXT · package root
2655a93625fdfb9b…
35.6 KB
PHP · includes
4a3f3b1c9fb51897…
33.9 KB
JS · assets
b20941a35cb79295…
27.5 KB
PHP · includes
caebf96bed431e5d…
23.7 KB
PHP · includes/admin
93d39ec54002d23d…
22.1 KB
PHP · includes/admin
48bb538d1cd0ab03…
19.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.