Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · images/demo/slider
406208b22e67b42d…
550.7 KB
JPG · images/demo/slider
4e48284de8723393…
544.5 KB
JPG · images/demo/slider
4c91c773f85e94db…
544.5 KB
JPG · images
efb9092e651c1aff…
354.8 KB
JS · js/vendor
8ef4cdedb9f8346b…
288.4 KB
JS · js/vendor
61d6a181c5f07558…
283.5 KB
TTF · fonts
5894a3649b213cf5…
219.3 KB
TTF · fonts
0fcbdb5cbeea00ae…
217.4 KB
Code signals
5 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution5
shell_exec
Runs an operating-system command
System command2
preg_replace /e
The /e modifier executed the replacement as code
Code execution2
new Function()
Builds a function from a string
Code execution2
eval
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.