Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · assets/img/hero-img
cb029d097c32c6c5…
1.62 MB
TTF · assets/fonts/fontawesome
6687687c70d502ff…
1.18 MB
TTF · assets/fonts/fontawesome
b8ef1ff99503a561…
1.16 MB
TTF · assets/fonts/fontawesome
7c41f14e1e8bbe77…
1.05 MB
TTF · assets/fonts/fontawesome
daa07950214eae56…
954.5 KB
TTF · assets/fonts/fontawesome
bbab2beb558f176d…
845.9 KB
MAP · assets/css
c4c67449a4816194…
611.3 KB
JPG · assets/img
5a6d33f726ac2d19…
606.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.