Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · assets/fonts
7cb9c670dc59c9a6…
473.5 KB
EOT · assets/fonts
c0380e446999dbaa…
105.0 KB
WOFF · assets/fonts
030cd480e19712ac…
104.9 KB
TTF · assets/fonts
4facd476a47a9b4e…
104.8 KB
JS · assets/js
2424daa50ccb4d0e…
91.8 KB
WOFF2 · assets/fonts
1879250fd01e244a…
47.3 KB
PHP · vendor/composer
7157b3fd71f9148e…
16.6 KB
PHP · vendor/composer
d4b2313e562edf94…
16.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request3
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.