Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · assets/images
…
2.71 MB
JSON · assets/plugins/font-awesome/metadata
…
2.65 MB
JPG · assets/images
…
2.04 MB
JPG · assets/images
776dd413a577f455…
1.16 MB
JS · assets/plugins/font-awesome/js
8277033f6aea0079…
1.06 MB
JS · assets/plugins/apexcharts/dist
62e3376caa7126a9…
1.01 MB
JS · assets/plugins/font-awesome/js
16e8f08eb363930c…
1.01 MB
JS · assets/plugins/apexcharts/dist
879c7bcc36e4c07b…
967.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution4
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.