Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · woo-shortcodes
65118f4235838be9…
68.2 KB
PNG · theme
f85d4c49c89d6231…
54.0 KB
PNG · theme/layers
808de5579b081925…
50.2 KB
CSS · woo-shortcodes
215790a4e15584ae…
26.8 KB
PHP · admin/config
a03ae073d9e603b1…
25.6 KB
PNG · admin/images
772b9a4a936e2b15…
23.5 KB
JS · admin/js
fa821f74f2d40428…
23.1 KB
CSS · theme
8748fe014a2f18d3…
22.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
create_function
Removed in PHP 8; builds a function from a string
Code execution2
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.