Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · assets/css
6c21c438e80f18ee…
1000.1 KB
JS · assets/js
f308109e8936e4a7…
524.4 KB
CSS · assets/css
2ce33b9a4bf65ee5…
293.6 KB
CSS · assets/css
cdcdfd2d2828f5f3…
267.6 KB
JS · assets/js
c501f66000a227cd…
251.0 KB
JS · assets/js/plugins
fa68ff3ed6f6cc8c…
242.0 KB
SVG · assets/fonts
984ed58aaa112ada…
233.6 KB
SVG · assets/fonts
570d0722ca73fb20…
233.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.