Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · public/img
a913ba92f5c07600…
19.2 KB
PHP · public/views
3ca576a38d271d71…
17.8 KB
PHP · com/classes
c4e2e1cc9bc4f63b…
13.0 KB
JS · public/js
b93f419e1e9cf8cf…
3.6 KB
PHP · com/classes
2efedfc3e36fe5ab…
3.1 KB
JS · public/js
31b7d610e698bc60…
2.3 KB
PHP · com/config
df1dc69cfee392b1…
2.3 KB
PHP · com/classes/_detection
1666cef6ff4b731d…
2.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
1 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.