Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
DB · documentation/img
…
2.07 MB
SVG · main-file/assets/webfonts
4ee1b170ff51b7fd…
819.7 KB
SVG · main-file/assets/webfonts
85eee11562ca8330…
673.8 KB
PNG · main-file/assets/img/shape
034d02d3f710476a…
365.7 KB
PNG · main-file/assets/img/shape
7fcab64e29416ece…
203.0 KB
EOT · main-file/assets/webfonts
d5342ae679d7064d…
187.6 KB
TTF · main-file/assets/webfonts
9313de7304bef452…
187.3 KB
CSS · main-file/assets/css
0c5ed985fdbddc02…
158.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.