Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes/tcpdf
decebf0b74a22d0b…
876.2 KB
Z · includes/tcpdf/fonts
6683637386a45764…
853.1 KB
PHP · includes/tcpdf/fonts
402b00e115bbd9aa…
372.1 KB
Z · includes/tcpdf/fonts
b2dba965bd5dc463…
353.8 KB
PHP · includes/tcpdf/fonts
d1f3851a25a9849a…
321.2 KB
PHP · includes/tcpdf/include
f638dabefa06b48d…
306.1 KB
Z · includes/tcpdf/fonts
eaedf9086e3609c8…
294.2 KB
PHP · includes/tcpdf/fonts
8fd4ba8953c88aa5…
289.4 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation4
gzinflate
Decompresses a string in memory
Obfuscation3
eval (JavaScript)
Executes a string as code
Code execution2
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.