Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · js
…
3.55 MB
JS · js
d0872ac2b8e0b28c…
663.2 KB
MAP · js
6c69c5b28541c448…
380.9 KB
CSS · css
fc04dae676390744…
101.8 KB
JS · js
754402ba7286b838…
101.0 KB
MAP · js
6d34d9a9ecf08a1c…
63.3 KB
MAP · js
115ba30d7a67fe10…
44.9 KB
MAP · js
cf256165f0efa6a2…
38.0 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
new Function()
Builds a function from a string
Code execution1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.