Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · i18n/languages
be6510476f6c38b5…
450.0 KB
PO · i18n/languages
2a5840587a599ffc…
435.0 KB
SVG · assets/dist/fonts
ad6157926c1622ba…
434.0 KB
SVG · assets/fonts
ad6157926c1622ba…
434.0 KB
PO · i18n/languages
8d506c2ba3d93196…
425.4 KB
PO · i18n/languages
33b81ceac5569c52…
401.9 KB
PO · i18n/languages
ec0edc693da4a879…
392.5 KB
PO · i18n/languages
5dea7c1447d49a4a…
388.7 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution2
curl_exec
Makes an outbound HTTP request
Remote request1
assert
Can execute a string as code on old PHP
Code execution1
unserialize
Unsafe when given untrusted input
Deserialization1
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.