Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · libs/flatpickr
1eeab1cb779471a0…
49.5 KB
POT · package root
e491aa0637035744…
35.7 KB
PHP · clean
50013bbc12a0051b…
31.8 KB
PHP · api
f8253ab25b4d7745…
28.9 KB
PHP · core
383185fd94db8b26…
22.4 KB
SCSS · scss
c1ac54e359f49686…
18.4 KB
CSS · css
100f586bfeddf04d…
16.5 KB
PHP · core
855e3cca62d717c6…
16.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.