Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · assets/css
7f8e420a4ac3ea7f…
34.4 KB
JS · assets/js
7e9987d3f3fefccd…
17.5 KB
PHP · functions
9408b20a88ea7f9a…
9.3 KB
PO · languages
8185fc25a0009637…
7.1 KB
CSS · assets/css
e8ff525312873228…
6.4 KB
DS_STORE · package root
028e65ec017e53c3…
6.0 KB
PHP · functions
b80d8707bdd223e3…
5.8 KB
PHP · functions
dba3bd4259137e56…
5.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.