Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
ZIP · package root
…
15.63 MB
ZIP · framework/plugins
…
7.01 MB
XML · demo
…
6.28 MB
PACK · .git/objects/pack
…
2.51 MB
SVG · assets/font/fontawesome
00a9c9cba00068f6…
886.0 KB
SVG · assets/font/fontawesome
a5f1c1202ed85f63…
706.1 KB
ZIP · demo/sliders
a65f1b1277dd9af4…
612.4 KB
PNG · assets/img
ef4550d8a9c0444d…
497.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.