Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · fonts/fontawesome/metadata
…
4.48 MB
JSON · fonts/fontawesome/metadata
…
4.07 MB
JS · fonts/fontawesome/js
8a3ed5d626a6da64…
1.49 MB
JS · fonts/fontawesome/js
26fc9c78bb9ae907…
1.40 MB
MAP · assets/vendors/videojs
abdfea3a116932a9…
845.3 KB
SVG · fonts/fontawesome/sprites
4b743e272030ad6a…
839.3 KB
MAP · assets/vendors/videojs/alt
833b95a491862a9b…
836.7 KB
JS · fonts/fontawesome/js
e3783c68ab293455…
826.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.