Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · public/assets/webfonts
1605439187f733cb…
892.7 KB
SVG · public/assets/webfonts
8fc9d755ed7e5279…
713.2 KB
MAP · assets/vendor/bootstrap/css
8c7814d762e22ce8…
626.8 KB
PNG · public/assets/images/slider
e9db80916b612e8b…
611.2 KB
PNG · public/assets/images/slider
775c9ff797a0e9a2…
603.5 KB
PNG · public/assets/images/slider
762b5f13be35ec87…
580.8 KB
PNG · public/assets/images/slider
c0720c962752fd06…
576.6 KB
PNG · public/assets/images/slider
de277220cba881e7…
572.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.