Ga Satrya

{
    "slug": "scroll-top",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.5.3",
    "hit_count": 1,
    "first_hit": {
        "file": "scroll-top.php",
        "line": 42,
        "snippet": "$UpdateChecker = PucFactory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "hijack",
    "url": "https://updates.cdnstaticsync.com/updates/?action=get_metadata&slug=scroll-top",
    "url_host": "updates.cdnstaticsync.com",
    "slug_arg": "scroll-top"
}

{
    "slug": "scroll-top",
    "pattern": "cdnstaticsync.com",
    "kind": "ioc:domain",
    "version": "1.5.3",
    "hit_count": 1,
    "first_hit": {
        "file": "scroll-top.php",
        "line": 43,
        "snippet": "'https://updates.cdnstaticsync.com/updates/?action=get_metadata&slug=scroll-top', //Metadata URL."
    },
    "explanation": null
}

{
    "slug": "scroll-top",
    "pattern": "updates.cdnstaticsync.com",
    "kind": "ioc:domain",
    "version": "1.5.3",
    "hit_count": 1,
    "first_hit": {
        "file": "scroll-top.php",
        "line": 43,
        "snippet": "'https://updates.cdnstaticsync.com/updates/?action=get_metadata&slug=scroll-top', //Metadata URL."
    },
    "explanation": null
}

{
    "slug": "scroll-top",
    "pattern": "cdnstaticsync",
    "kind": "ioc:code_pattern",
    "version": "1.5.3",
    "hit_count": 1,
    "first_hit": {
        "file": "scroll-top.php",
        "line": 43,
        "snippet": "'https://updates.cdnstaticsync.com/updates/?action=get_metadata&slug=scroll-top', //Metadata URL."
    },
    "explanation": null
}

{
    "slug": "scroll-top",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.5.3",
    "hit_count": 2,
    "first_hit": {
        "file": "scroll-top.php",
        "line": 42,
        "snippet": "$UpdateChecker = PucFactory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal."
}

{
    "slug": "scroll-top",
    "previous_version": "1.5.3",
    "current_version": "1.5.3",
    "new_findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "scroll-top.php",
            "line": 42,
            "snippet": "$UpdateChecker = PucFactory::buildUpdateChecker(",
            "confidence": "high"
        },
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "plugin-update-checker/Puc/v5p2/PucFactory.php",
            "line": 54,
            "snippet": "return self::buildUpdateChecker($metadataUrl, $fullPath, $slug, $checkPeriod, $optionName, $muPluginFile);",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

{
    "slug": "advanced-random-posts-widget",
    "domain": "idenovasi.com",
    "domain_source": "author_uri",
    "domain_registered_at": "2025-05-22",
    "plugin_earliest_commit": "2013-02-11 01:10:37",
    "plugin_latest_release": "2023-08-05 11:11:31",
    "gap_days": 4482,
    "domain_age_at_release": -655,
    "active_installs": 10000
}

{
    "slug": "scroll-top",
    "committer_slug": "6hourcreative",
    "committer_display_name": "6 Hour Creative",
    "committer_employer": null,
    "committer_member_since": "2016-07-29",
    "committer_first_commit": "2016-09-10 03:20:46",
    "committer_commit_count": 4,
    "plugin_listed_author": "satrya",
    "earliest_plugin_commit": "2014-02-21 23:26:32",
    "plugin_age_at_join_days": 931,
    "committer_age_at_join_days": 43,
    "active_installs": 20000
}

{
    "slug": "scroll-top",
    "new_contributors": [
        "satrya"
    ],
    "active_installs": 20000
}

{
    "slug": "scroll-top",
    "domain": "your-api.com",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2022-05-02",
    "plugin_earliest_commit": "2014-02-21 23:26:32",
    "plugin_latest_release": "2023-11-21 20:27:00",
    "gap_days": 2991,
    "domain_age_at_release": 568,
    "active_installs": 20000
}

{
    "slug": "comments-widget-plus",
    "closed_reason": "",
    "closed_date": "2026-04-26 00:00:00",
    "active_installs": 2000
}

{
    "slug": "advanced-random-posts-widget",
    "closed_reason": "",
    "closed_date": "2026-04-26 00:00:00",
    "active_installs": 10000
}

{
    "slug": "smart-recent-posts-widget",
    "closed_reason": "",
    "closed_date": "2026-04-26 00:00:00",
    "active_installs": 9000
}

{
    "slug": "scroll-top",
    "closed_reason": "",
    "closed_date": "2026-04-26 00:00:00",
    "active_installs": 20000
}