Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
POT · languages
a56fbb17a81d7ffa…
63.6 KB
PHP · includes
0f409877d2f26b8a…
62.8 KB
JS · assets/js/frontend
864a54b5c71bc09d…
58.2 KB
PHP · includes/compatibility/modules/apfs
a68c17bb7065e0f0…
53.1 KB
TXT · package root
33f867527e69e46d…
44.9 KB
PHP · includes
821d6f1e82174a76…
44.9 KB
PHP · includes
ffe9b01fe35d02ff…
42.3 KB
PHP · includes
cef06ffb26ed5982…
42.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.