Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
TXT · vendors/cmb2
9e7b567e2715a2b4…
90.3 KB
MD · vendors/cmb2
ece716280d576407…
75.6 KB
PHP · vendors/cmb2/includes
51f9e6ad5458f221…
51.3 KB
CSS · vendors/cmb2/css
e0aba22c490f8458…
48.1 KB
CSS · vendors/cmb2/css
975d8fe6630a268b…
48.0 KB
PHP · vendors/cmb2/includes
3196b3ba884366c7…
44.8 KB
CSS · vendors/cmb2/css
9ba7de51d6ba2554…
41.6 KB
CSS · vendors/cmb2/css
0377eb517a1a341c…
41.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.