Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js/vendor/timepickeraddon
f610e5fc421ad8f5…
78.9 KB
JS · js/vendor/select2
feb9806bd39dba8d…
74.3 KB
JS · js/vendor/datepicker
b7d0e87bc6267f7f…
48.4 KB
PHP · classes/com
8a03fd1e7d2c8e56…
39.8 KB
JS · js/vendor/datepicker
fb0d6b802474570a…
38.7 KB
PHP · classes/admin
0fa1f2552a392892…
33.2 KB
JS · js/vendor/datepicker
43c848594d676286…
32.2 KB
PO · languages
2b97a5e7ec3f2e27…
28.7 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization3
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.