Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · node_modules/sass
…
5.40 MB
JS · node_modules/prettier/plugins
f0b0a73ecef9608f…
874.2 KB
MJS · node_modules/prettier/plugins
bf50c279afd95347…
873.6 KB
PHP · libraries/htmlpurifier
eeefa895ba324f6b…
689.1 KB
JS · node_modules/prettier/plugins
2e50e66a45bd0c29…
676.9 KB
MJS · node_modules/prettier/plugins
1ec21b127dfd8ffd…
676.5 KB
JS · node_modules/uglify-js/lib
52e96fcca1a6ad99…
639.1 KB
MJS · node_modules/prettier
957fef9460db2018…
617.0 KB
Code signals
8 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation10
new Function()
Builds a function from a string
Code execution8
assert
Can execute a string as code on old PHP
Code execution6
unserialize
Unsafe when given untrusted input
Deserialization4
curl_exec
Makes an outbound HTTP request
Remote request2
eval
Executes a string as code
Code execution2
atob
Decodes base64 in the browser
Obfuscation2
exec / system
Runs an operating-system command
System command1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.