Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · libraries
4555fcca796a0343…
148.5 KB
JS · static/js/jquery
59df6b8c994f6d96…
70.5 KB
PHP · libraries
774593d388d242e0…
48.4 KB
PHP · libraries
3a5d23d2b3eb6ef6…
29.3 KB
PNG · static/img
60f58522f97ef0c9…
15.6 KB
PHP · classes
f4761ec35772e737…
14.5 KB
PHP · package root
500a776d0648da73…
9.0 KB
PHP · src/Pro/Filtering
e05c9fe522fdc77f…
7.6 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
eval
Executes a string as code
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.