Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · lib/view/assets/javascript
40a80b597891115f…
223.1 KB
JS · lib/view/assets/javascript
8bef0be10897b2b3…
191.7 KB
JS · lib/view/assets/javascript
97ce162cca02efe5…
187.9 KB
JS · lib/view/assets/javascript
964e74e1551107c2…
185.9 KB
JS · lib/view/assets/javascript
6dacaaa3559bf0ee…
182.8 KB
PHP · lib/vendor/servmask/pro/controller
4bade3ea2db69826…
30.9 KB
PHP · lib/vendor/servmask/pro/view/schedules
109150a91dfb75cc…
23.0 KB
CSS · lib/view/assets/css
e381e42e76995d43…
22.0 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution5
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
7 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.