Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · orbit7-HTML/upload
a0327a90ad5f5e93…
1003.8 KB
PNG · orbit7-HTML/upload
84cf6eeef32441f8…
392.3 KB
JPG · orbit7-HTML/upload
d5862d9489de9e54…
370.4 KB
JPG · orbit7-HTML/upload
acbee781d545d748…
336.3 KB
JPG · orbit7-HTML/upload/slider-revolution
dd2066e4f988cb1d…
293.1 KB
JPG · orbit7-HTML/upload/flexslider
f8de4bf27614a482…
286.2 KB
JPG · orbit7-HTML/upload
8bbab534704498cb…
271.3 KB
JPG · orbit7-HTML/upload
5c604322b69f2e23…
264.8 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.