Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · dist
e14b033479657370…
1.56 MB
JS · dist
437845dfa1dad970…
948.3 KB
JS · dist
c9d0950dfae9b234…
624.0 KB
JS · dist
6321f8301f3ddb08…
603.2 KB
JS · dist
4c2f3470d215bc71…
587.1 KB
JS · dist
f77bd0cb339b4b6c…
496.3 KB
JS · dist
3ddf788370861fb6…
495.6 KB
JS · dist
3da678e7facf5ace…
487.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.