Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · assets/preview
…
2.47 MB
JPG · assets/preview
04a0a5a347ce87da…
1.86 MB
JPG · assets/preview
c44fdf17b2b8a967…
1.47 MB
JPG · assets/preview
e2004bb9ed8177ce…
1.41 MB
JPG · assets/preview
170e5db1d1adfcb7…
1.23 MB
JPG · assets/preview
79d3a05550a99f7f…
1.04 MB
JPG · assets/preview
f49684374cd8fde8…
1.03 MB
JPG · assets/preview
b720d26a584f7da5…
1.03 MB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.