Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · libs/codemirror6/dist
2d5b2061d9533e62…
588.3 KB
JSON · libs/codemirror6
79f301998807499b…
129.5 KB
PHP · class
1dc0f482d203e2a4…
51.0 KB
PHP · class
5506eee519a50934…
27.9 KB
CSS · css
29ab62c3fa999da4…
23.9 KB
CSS · css
ff31a69c91e4e3ae…
18.4 KB
CSS · css
a585aefa060c9519…
17.2 KB
PHP · package root
3298cae1e3ab6531…
11.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution5
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.