Objectives
hostile severity, 90% confident.
anti-analysis/timing
JavaScript time-based dormant code
suspicious severity, 78% confident.
anti-analysis/geofencing/region
Asia Africa country code cluster
suspicious severity, 75% confident.
credential-access/phishing
Reference to Google reCAPTCHA URL
suspicious severity, 92% confident.
evasion/security-bypass/llm
LLM jailbreak payload phrase
suspicious severity, 90% confident.
execution/autoinstall
Source invokes npm i package
suspicious severity, 95% confident.
impact/wipe/disk
Wiper with HTTP callback
notable severity, 90% confident.
anti-static/obfuscation/eval
Immediate invocation of new Function
notable severity, 95% confident.
credential-access/validation
Sets current WordPress user session
Micro-behaviors
notable severity, 100% confident.
data/control-flow
Loop variable incremented by a variable step
notable severity, 100% confident.
data/db
WordPress update_option function symbol
notable severity, 90% confident.
data/decode
JavaScript base64 decode via atob()
notable severity, 100% confident.
data/source/function
High density of funcs returning literals
notable severity, 100% confident.
fs/delete
PHP unlink function symbol
Metadata
20 of 72 traits shown
Identity
| SHA-256 | 382cc3b4922d985e6fee3b459a61422678014a68aba326039092d866d355348a |
|---|---|
| Canonical SHA-256 | 001c581d9fefb0580983f814894729cbd8d46cc24a16cc74104fcaf9d2571ce0 |
| Filename | jetformbuilder-3.6.2.1.zip |
| Package | jetformbuilder |
| Version | 3.6.2.1 |
Origin
| Source | forager |
|---|---|
| Feed | wordpress.org |
| Ecosystem | wordpress |
| Domain | wordpress.org |
| URL | https://downloads.wordpress.org/plugin/jetformbuilder.3.6.2.1.zip |
Timeline
| First seen | 17 Jun 2026 03:07 UTC |
|---|---|
| First analyzed | 17 Jun 2026 04:09 UTC |
| Last analyzed | 17 Jun 2026 04:09 UTC |
| Last updated | 17 Jun 2026 04:09 UTC |
Labeling
| Label | good |
|---|---|
| Label source | forager |
| Traits version | 27202 |
Not seeing what you expected? Let us know