Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · assets/fonts
52cae1b0f2dc4bd3…
473.6 KB
EOT · assets/fonts
c0380e446999dbaa…
105.0 KB
WOFF · assets/fonts
030cd480e19712ac…
104.9 KB
TTF · assets/fonts
4facd476a47a9b4e…
104.8 KB
JS · assets/js
2424daa50ccb4d0e…
91.8 KB
WOFF2 · assets/fonts
1879250fd01e244a…
47.3 KB
PHP · lib/recurly
ee964d306bf850e8…
14.1 KB
JS · assets/js
9e0a0a873d15d541…
11.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request3
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.