Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · i18n/languages
529c2f156d69463f…
508.5 KB
PO · i18n/languages
67cc239d859f5997…
491.0 KB
PO · i18n/languages
cc6c07e0f353293e…
481.4 KB
PO · i18n/languages
be657247e55b66bc…
454.5 KB
PO · i18n/languages
adbf0c8c08c75bf6…
443.3 KB
PO · i18n/languages
3c3844c426331617…
440.7 KB
SVG · assets/dist/fonts
ad6157926c1622ba…
434.0 KB
SVG · assets/fonts
ad6157926c1622ba…
434.0 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution2
curl_exec
Makes an outbound HTTP request
Remote request1
assert
Can execute a string as code on old PHP
Code execution1
unserialize
Unsafe when given untrusted input
Deserialization1
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.