Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · css/fonts
d67041fe5d50eef9…
357.0 KB
MAP · css/bootstrap
aaf99fdfeec73316…
240.2 KB
TTF · css/fonts
7b5a4320fba0d4c8…
138.7 KB
SVG · css/fonts/js-flat
f5b57a422d576e7e…
132.4 KB
JPG · images/pink
99581ed0bb66b5a2…
121.3 KB
JPG · images/yellow
ee0b87bff82b3bc6…
121.0 KB
JPG · images/green
2acada1d818fd817…
121.0 KB
JPG · images/light_blue
dd02de7f9c9b57dc…
121.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.