Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · theme/assets/plugins/font-awesome/metadata
…
2.65 MB
JS · theme/assets/plugins/font-awesome/js
8277033f6aea0079…
1.06 MB
JS · theme/assets/plugins/apexcharts
026c1cea7ebaabf5…
1.01 MB
JS · theme/assets/plugins/font-awesome/js
16e8f08eb363930c…
1.01 MB
SVG · theme/assets/plugins/font-awesome/webfonts
22f6af77ffeeb267…
729.2 KB
SVG · theme/assets/plugins/font-awesome/webfonts
7aadbc4ac7f80413…
696.9 KB
JS · theme/assets/plugins/fullcalendar
00cebb262349dbba…
660.0 KB
MAP · theme/assets/plugins/bootstrap/css
a49724ef5c08080d…
608.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.