Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · img/light-dose
3f7350e96471d5e4…
1.53 MB
PNG · img/light-dose
0c79238d132bb8df…
1.14 MB
PNG · img/light-dose
ae795ba0ad1eb79c…
1008.4 KB
PNG · img/light-dose
0ce01f33588f15bb…
794.8 KB
PNG · img/light-dose
60393a15ba769988…
565.2 KB
PNG · img/light-dose
6c1ee2ee72b50b45…
556.3 KB
PNG · img/light-dose
33a6939ef2de7bd4…
554.8 KB
PNG · img/light-dose
ed729d28d2bcb47b…
515.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution3
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.