Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · assets/css/admin
d96190b63a64e38e…
448.9 KB
SVG · assets/css/fonts
b0387cc7b1ca00f2…
377.4 KB
PHP · includes
e80cf1aecdf4a132…
372.3 KB
CSS · assets/css/admin
82fe234f93100f33…
350.2 KB
JS · assets/js/admin
d9babc3af3f4640f…
338.0 KB
JSON · assets
da4e4f245b22d68a…
261.1 KB
CSS · assets/css/common
d3e77b3f5678c713…
257.5 KB
JS · assets/js/admin
cf89872097d7761f…
252.0 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization22
curl_exec
Makes an outbound HTTP request
Remote request2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.