Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · fonts
2ed66bb158d0b835…
819.7 KB
EOT · fonts
456c2aaf2abd6fae…
737.2 KB
TTF · fonts
541d4e4080c118e4…
736.9 KB
SVG · fonts
75fc34229fcb7561…
675.6 KB
SVG · fonts
8e3586389bb4cd01…
382.4 KB
SVG · fonts
54e03743bd2ed3e5…
305.4 KB
HTML · fonts
bc9ecde67d9898b6…
250.4 KB
EOT · fonts
d495a9a78fae6f49…
187.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
15 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.