Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/lib/choices
ad077b60e0749378…
201.0 KB
JS · assets/js/admin/lib
6cce6c12795bdba7…
155.0 KB
MAP · assets/js/public
a80f6eb14029dab8…
141.5 KB
JS · assets/js/admin/lib
73b295ede0a1d0e6…
107.7 KB
PO · languages
5a77064767f7688a…
101.0 KB
POT · languages
a930fa1ea55c60a4…
92.3 KB
JS · assets/lib/choices
1862d59d86952050…
86.5 KB
MD · vendor/guzzlehttp/guzzle
2313e7f1d3ab8e37…
85.8 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation5
new Function()
Builds a function from a string
Code execution2
unserialize
Unsafe when given untrusted input
Deserialization1
exec / system
Runs an operating-system command
System command1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.