Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages
fe7e51bb9f9bcea2…
746.0 KB
PO · languages
e0b77a15ef3239d5…
701.3 KB
PO · languages
e0b77a15ef3239d5…
701.3 KB
POT · languages
4e3128580dc44b8c…
701.2 KB
PO · languages
c21e82e9178328cd…
611.7 KB
PO · languages
c21e82e9178328cd…
611.7 KB
PO · languages
73688830f7a76382…
568.0 KB
PO · languages
6725ee76c411475b…
567.5 KB
Code signals
10 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation24
exec / system
Runs an operating-system command
System command13
curl_exec
Makes an outbound HTTP request
Remote request2
eval
Executes a string as code
Code execution2
unserialize
Unsafe when given untrusted input
Deserialization2
eval (JavaScript)
Executes a string as code
Code execution1
create_function
Removed in PHP 8; builds a function from a string
Code execution1
assert
Can execute a string as code on old PHP
Code execution1
gzinflate
Decompresses a string in memory
Obfuscation1
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.