Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · html/vendors/pdfmake/build
527fa15bfcea21ee…
951.6 KB
JS · html/vendors/tinymce
c4c2b7377cf5ba1d…
893.9 KB
JS · html/vendors/pdfmake/build
c2f1ff513843fdf5…
849.9 KB
JS · html/vendors/echarts/dist
3ab0d778a79c9898…
726.1 KB
JS · html/vendors/fullcalendar/dist
b8a7b88c2835f10e…
609.4 KB
CSS · html/dist/css
c1769605c86b97d0…
563.2 KB
JS · html/vendors/moment/min
b809ad707c5c2bba…
514.1 KB
JS · html/vendors/tinymce/themes/mobile
1d79a8090519d179…
422.7 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution6
atob
Decodes base64 in the browser
Obfuscation3
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.