Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · package root
251926c86d9274b8…
134.1 KB
PHP · includes
ceb08941f0c4e553…
46.6 KB
TXT · package root
a5c30e8b29892faf…
42.2 KB
PHP · includes/Crawler-Detect
c92d882172ed64c9…
35.0 KB
PHP · includes/Crawler-Detect/src/Fixtures
c23e08bc5a91d484…
28.6 KB
CSS · assets/css
3e07497e4da0776e…
24.1 KB
PHP · modules
b82a0bcdec6aa09e…
22.2 KB
MAP · assets/css
2b494ee7abfe61ba…
21.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.