Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · admin/js
0b0287440b710168…
531.6 KB
JS · admin/js
cc5eafb6340d9061…
371.6 KB
PO · languages
9beecbca84149723…
300.1 KB
JS · admin/js
07aea8684b811d8a…
283.7 KB
JS · admin/js
01311ddb6b0ea995…
275.1 KB
JS · admin/js
6120b1f69780511f…
214.8 KB
POT · languages
2bfb14a040358396…
203.1 KB
SVG · public/svg
e0267f48e2fbec9f…
183.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution8
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.