Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · frontend/js
5b9d66c3bf7ee478…
490.9 KB
SVG · frontend/css/asset/icons
630fa1d8c74fd3a7…
322.4 KB
PHP · lib
1056f26a477721ec…
148.5 KB
MAP · frontend/js
d4a64ad441535f8f…
139.6 KB
EOT · frontend/css/asset/icons
5f671908d3c83edb…
138.4 KB
WOFF · frontend/css/asset/icons
390a078d38457ed5…
138.3 KB
TTF · frontend/css/asset/icons
878dde8b78a1f86e…
138.2 KB
CSS · frontend/css/asset
ad96484d7d3a3193…
124.5 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request3
create_function
Removed in PHP 8; builds a function from a string
Code execution1
gzinflate
Decompresses a string in memory
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.