Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
GIF · src/images
f982b411bcb4647a…
1.25 MB
GIF · dist/assets/images
f982b411bcb4647a…
1.25 MB
JS · dist/assets/vendor/fontawesome-free/js
19a7ab5f66bf0ee3…
1.20 MB
MAP · dist/assets/vendor/bootstrap/dist/css
ad95c438e0aa0ea9…
638.2 KB
CSS · dist/assets/css
e00ef796123f5792…
355.1 KB
CSS · dist/assets/css
60d4af2592cc0cbc…
355.1 KB
CSS · dist/assets/css
8f05e78e236578d7…
355.1 KB
CSS · dist/assets/css
384a13f1f486e0a0…
355.1 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution4
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation2
curl_exec
Makes an outbound HTTP request
Remote request2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.