Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
ZIP · Bundled Plugins
…
7.93 MB
ZIP · Bundled Plugins
…
7.67 MB
XML · Assets/Dummy Data/XML
…
2.40 MB
ZIP · Theme Files
d851411c8afb44b4…
1.53 MB
JSON · Assets/Dummy Data/Content
bd727617a1f9b043…
1.48 MB
ZIP · Assets/Dummy Data/Slider
4a003a8423bac463…
856.5 KB
ZIP · Assets/Dummy Data/Slider
5f9cc4d2f1e3b0d7…
588.4 KB
ZIP · Assets/Dummy Data/Slider
d4c7e032f0ab8ed0…
563.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.