Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages
95b703e7f007ef74…
162.4 KB
POT · languages
1ad1ee91b07b64ad…
89.1 KB
JS · assets/js
7cd3c2aa9633d584…
63.2 KB
MO · languages
79e5cceca6bd46f4…
53.6 KB
PHP · classes
207c84a3cf6eee92…
53.3 KB
PHP · classes/admin/vendors
a55a1a1a28931cf6…
50.6 KB
PHP · classes/abstracts
179659e6567398f5…
40.5 KB
PHP · classes/admin
bdf132f208010e30…
38.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.