Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · package root
12c138eee83e6281…
139.4 KB
MAP · assets/js/min
cd35e23590609162…
90.2 KB
JS · assets/js/min
b21a63f1e99f3368…
70.4 KB
MAP · assets/js/min
f3f26aeca290fe73…
46.6 KB
JS · assets/js/min
285901d045753c7c…
37.7 KB
JS · deprecated/js/dev
4a500e183d95c00a…
24.1 KB
JS · deprecated/js/dev
d61b3e2ff98107a9…
18.9 KB
JS · deprecated/js/min
7d1a2c24e3d86319…
15.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution4
Referenced hosts
4 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.