Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · dist/js
27f0fddb9cc9ec14…
1.48 MB
PHP · vendor/freemius/includes
cb7063cffd6330d5…
997.2 KB
CSS · dist/css
7cb650954b8f611d…
781.9 KB
CSS · dist/css
8afa00820b2d86e1…
416.2 KB
JS · vendor/freemius/assets/js/pricing
da69c6bfc9e23323…
292.6 KB
CSS · dist/css
735fe589efa1ed0d…
235.2 KB
PHP · classes/chatbot
534e963d3668c10e…
195.9 KB
PHP · classes/content-writer
7d0009e34c808364…
189.7 KB
Code signals
6 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation14
curl_exec
Makes an outbound HTTP request
Remote request2
new Function()
Builds a function from a string
Code execution2
gzinflate
Decompresses a string in memory
Obfuscation2
atob
Decodes base64 in the browser
Obfuscation1
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.