Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
DATA · admin/includes
aff74aa644b3419b…
301.5 KB
PHP · includes
e818b562e92996c2…
215.1 KB
JS · public/assets/js
a706e4c7b3120dbd…
161.4 KB
PHP · package root
cd887ccee6d21e0b…
120.3 KB
PHP · admin
01b9240d05c0efa1…
113.1 KB
TXT · package root
00e817fd833b5554…
81.8 KB
PHP · includes
242e1b61aad7bd89…
72.9 KB
CSS · public/assets/css
1b2f8ec5bd66544e…
71.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization4
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.