Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
GIF · html/img
f37d40ee1ed1c48a…
1.62 MB
SVG · html/fonts
15074c3d5e761ab0…
797.8 KB
SVG · html/fonts
451d7c74a869e7b4…
678.3 KB
DB · html/img
637124f7df7736af…
469.0 KB
CSS · html/css
68b19a84d9ea8eb2…
416.5 KB
PNG · html/img
724d3d4f882327ec…
409.8 KB
JS · html/js/vendor
df97215b1b499f9e…
311.5 KB
SVG · html/fonts
91f068a06a78d5ec…
270.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution15
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.