Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSV · premium/support
…
3.51 MB
JS · app
922e466c5652533a…
530.0 KB
CSV · premium/support
dd02a5d0034a6c1d…
459.7 KB
JS · app
84cca41f0efc85a9…
369.9 KB
CSV · premium/support
1aa6fb625158001c…
225.4 KB
CSV · premium/support
1dd97a6901abee8a…
95.8 KB
CSV · premium/support
c409d1d5f674016d…
77.6 KB
CSV · premium/support
6a0036de025e1057…
68.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.