Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · wedo/javascript
0b204f939b11134b…
179.2 KB
CSS · wedo/stylesheets
e7de09bf1f8f82c0…
152.2 KB
JS · wedo-document/javascript
f554d2f09272c6f7…
91.2 KB
HTML · wedo
695a8e768ec42345…
88.7 KB
JS · wedo/javascript
8adc3167cc85db1a…
84.8 KB
JPG · wedo/images/blog
7186e77e6e0eb8e8…
61.9 KB
JPG · wedo/images/blog
ac801214191f6526…
61.4 KB
CSS · wedo/stylesheets
96f71b205f126ed8…
57.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.