Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · images
5acc48ed1ae6ae72…
503.0 KB
SVG · fonts
bfdef833219a6edf…
306.1 KB
JPG · images
2c923489d29e45cc…
299.0 KB
JS · js
a140dfb0e8a95316…
264.9 KB
JPG · images
141e71e5b819d0b0…
242.8 KB
CSS · css
618da9897c536147…
211.5 KB
JPG · images
a984b43aa6dde1eb…
176.5 KB
JS · js/min
8f410eec48c6efd5…
162.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.