Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · libs/codemirror6/dist
2d5b2061d9533e62…
588.3 KB
JSON · libs/codemirror6
79f301998807499b…
129.5 KB
PHP · class
d041bce336e9431b…
25.9 KB
CSS · css
4f040e6d1a3b8abf…
23.9 KB
CSS · css
3bc1991c55c9b146…
18.4 KB
CSS · css
d3c725e24e91c522…
17.2 KB
PHP · package root
ef29776e647fb812…
10.5 KB
TXT · package root
ab80844e8431b470…
2.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution5
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.