Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · source/assets/img/product
…
2.97 MB
SVG · source/assets/fonts
a4f78a6512b9d70b…
1.63 MB
PNG · source/assets/img/shape
a9efc06e89dcac68…
586.7 KB
PNG · source/assets/img/products
5cacc1b2a1e9c902…
301.4 KB
PNG · source/assets/img/products
e0e63389005565ab…
301.4 KB
PNG · source/assets/img/products
41de293e5c970363…
295.2 KB
PNG · source/assets/img/products
a6803e5a80ac1ad8…
279.7 KB
SVG · source/assets/fonts
91f068a06a78d5ec…
270.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution8
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.