Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · assets/images
224d4ca88717f068…
163.4 KB
JS · includes/svx-settings/js
058734ae2c932129…
110.9 KB
JS · assets/js
15af8c882262715d…
74.6 KB
PHP · includes
4fa64734cf9d37db…
64.6 KB
PHP · includes/svx-settings/less/Less
47f10352387d16e3…
57.4 KB
PHP · includes/svx-settings
07c05464b361bb5e…
48.2 KB
CSS · assets/css
31bdd142a6b7a421…
45.6 KB
CSS · assets/css
4829fdf4f086eb96…
45.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.