Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · js/built
3fb08b88cf0d4d3e…
126.3 KB
MAP · js/built
e973100aebf937d4…
93.0 KB
PHP · package root
09c08202a5605b5e…
57.1 KB
JS · js/built
44ced89045d232e3…
36.8 KB
JS · js/built
698be9235b4767af…
21.4 KB
TXT · package root
8177f97513213526…
17.7 KB
PHP · vendor/composer
1e4525198301d1ed…
17.0 KB
PHP · vendor/composer
d4b2313e562edf94…
16.0 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
8 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.