Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · assets/css
24b828cff10fed14…
1.04 MB
CSS · assets/css
e8b95df17c45a5ad…
983.7 KB
JS · assets/js/plugins
b084a879f42dc518…
668.6 KB
JS · assets/js/plugins
c7439e859eb936b2…
615.4 KB
SVG · assets/fonts
fc378232f9dad500…
436.6 KB
JS · assets/js/vendor
d1606c74ec89c26a…
257.0 KB
JS · assets/js/plugins
a3612d757c325f93…
254.4 KB
JS · assets/js/vendor
b44b1f2aabc8467b…
253.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.