Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
e4f1f1bde2ad6a38…
540.7 KB
JS · static/js/plugins
6d7dd97b1b8f9a6d…
121.8 KB
JS · static/js/libraries
a863a77e9ee263a0…
113.2 KB
CSS · css
4285e8cfebdcc5e5…
93.6 KB
JS · js
ac10caabc261c72e…
87.2 KB
JS · static/js/framework
160a426ff2894252…
84.9 KB
CSS · css
631e40c3a6ff0efc…
56.3 KB
JPG · img/assets/sectionVideo
07f75ba7647a747b…
52.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.