Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js/library
4d0abce315fabe4c…
220.9 KB
JS · js/library
5130a11b61a3fb71…
70.8 KB
CSS · css
26b348256e402122…
64.1 KB
PNG · images
e439a1ff8e19d68b…
34.4 KB
PNG · images
e0e5ed366134fb0a…
27.8 KB
PNG · images
ef44b225dbff056d…
23.1 KB
PNG · images
fc68191921c5182b…
22.2 KB
JS · js
3cc4fc554626c23b…
22.1 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
17 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.