Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · Delicio-HTML/images
5ebc25abf658ef89…
249.2 KB
SVG · Delicio-HTML/css/fonts
b751f81b4b0db77c…
197.4 KB
JPG · Delicio-HTML/images
9f22942c99100d6d…
191.1 KB
JPG · Delicio-HTML/images
ff0b0e1c4ad13577…
191.0 KB
JPG · documentation/assets/images
95a865bc18e80669…
177.3 KB
JPG · Delicio-HTML/images
e6bd32e26e9d28bc…
144.4 KB
JPG · Delicio-HTML/images
e82b8282dfbe63d0…
131.8 KB
JPG · Delicio-HTML/images
633282ff2ae99524…
131.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.