Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · lib/updater
6759b5757882acd0…
35.0 KB
POT · lang
2012b68abd5a49f2…
19.3 KB
PHP · includes/admin/settings
eeb2b2ab4e528a55…
15.4 KB
PHP · includes
1a4e5b1d21b5820a…
15.4 KB
PHP · lib/updater
eae3a21f469b99f4…
13.4 KB
PHP · includes
326f195bcad2a5ec…
11.3 KB
PHP · includes
3c4c21d404221ee4…
10.8 KB
PHP · lib/updater
bbd17ad0c509aeb0…
9.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.