Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · vendor/prism
271816f328df6f3a…
1.17 MB
PHP · package root
031f8e252e845e97…
127.5 KB
ZIP · plugins
fd9bc4944c479332…
79.8 KB
PHP · package root
dd6423366c5ab9e5…
60.8 KB
JS · vendor/prism/previewers
5a8a82a1ff7f67ef…
38.2 KB
POT · package root
eba804d4410bf806…
30.4 KB
JS · vendor/prism/line-highlight
ebfc9e2f4742bb86…
17.0 KB
JS · vendor/prism/show-language
2ad8eb02198e0f93…
13.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.