Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js/admin
17f2c4a318404a1d…
150.7 KB
TXT · package root
43337fe271a63452…
125.5 KB
PHP · includes
9544912112164a14…
98.2 KB
JS · assets/js/frontend
4bc08d15e1f0e5f6…
97.9 KB
PHP · includes
7b623762e434700b…
97.2 KB
POT · languages
1f6d722910cc4abe…
90.6 KB
PHP · includes
4f8abeff230f1246…
87.8 KB
PHP · includes/admin/meta-boxes
642b60d298071fc8…
70.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.