Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PO · languages
95b703e7f007ef74…
162.4 KB
POT · languages
fbde26291f46ea1a…
88.6 KB
JS · assets/js
7cd3c2aa9633d584…
63.2 KB
PHP · classes/admin/vendors
a92fde7c8c2c2ec2…
54.3 KB
MO · languages
79e5cceca6bd46f4…
53.6 KB
TXT · package root
9b9a0cb664632d0d…
53.4 KB
PHP · classes
156b72ad1ddbd3c8…
53.0 KB
PHP · classes/abstracts
4775c85f0bd1401e…
39.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.