Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes
3e908768c656f36f…
323.8 KB
JS · assets/js
d5ff0a87c25b8b28…
220.5 KB
JS · assets/js
8b2d00f9463fd921…
106.0 KB
PHP · templates
99598afa7f5a766b…
75.0 KB
GIF · assets/images
ec9b4a6ef6052cdc…
57.2 KB
PO · lang
1515f79a84128fcf…
55.9 KB
PO · lang
b0613a0cc88df766…
47.0 KB
PO · lang
f6fb7ec89e40c341…
46.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization6
Referenced hosts
8 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.