Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MP4 · placeholder/assets/images/dobule-exposure
…
8.78 MB
MP3 · placeholder/assets/images/whiteboard
…
5.84 MB
MP4 · placeholder/assets/images/dobule-exposure
…
3.13 MB
MP4 · placeholder/assets/images/dobule-exposure
ec26ba84d06f341f…
1.89 MB
MP3 · placeholder/assets/images/whiteboard
c629b589d98360ee…
819.3 KB
PNG · placeholder/assets/images/resources
e7e469753594c059…
663.4 KB
JPG · placeholder/assets/images/dobule-exposure
3c1976919a5bb05c…
557.5 KB
SVG · Documentation/css/fonts
c0c700e939d41bc6…
543.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.