Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
DB · color-styles/apple-green/layout
0158eed3149d132c…
175.5 KB
DB · color-styles/blue/layout
7d8f691e11e19228…
175.5 KB
DB · color-styles/green/layout
1cce6b2abe4e1e8d…
175.5 KB
DB · color-styles/purple/layout
792f1e7cb051b79a…
175.5 KB
DB · color-styles/red/layout
f80a485185f26ca3…
175.5 KB
PNG · package root
fe5c7e3348953afb…
167.6 KB
JPG · images/layout
18b0ccef0551e997…
78.7 KB
JPG · images/layout
337eaf4d92e6a769…
65.0 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
create_function
Removed in PHP 8; builds a function from a string
Code execution12
eval (JavaScript)
Executes a string as code
Code execution2
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.