Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · builder/js
…
2.33 MB
GIF · builder/images
…
2.29 MB
GIF · builder/images
…
2.24 MB
JS · builder/js/code-editor/ace
2e14b7aabac95d1a…
1.56 MB
JSON · builder/php/google-fonts
c33427916b10c9ad…
1.55 MB
SVG · builder/fonts
bf80f95a656380ef…
1.51 MB
SVG · builder/icons/materialdesignicons
bf80f95a656380ef…
1.51 MB
GIF · builder/images
d79948331f2e7a03…
1.43 MB
Code signals
6 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution20
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation12
eval
Executes a string as code
Code execution9
shell_exec
Runs an operating-system command
System command6
gzinflate
Decompresses a string in memory
Obfuscation3
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.