Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · build
8b597841dea6a8f9…
1002.6 KB
JSON · package root
b34956197f20085f…
609.0 KB
PHP · package root
63babbb95229c012…
177.3 KB
POT · languages
9a7582ec8aefc0c3…
124.4 KB
PHP · package root
7eaa349fb3f04e14…
75.1 KB
PHP · package root
96e410a1edf4448e…
74.1 KB
PHP · package root
4dc449ab8d369bd7…
55.0 KB
JS · libs/filter-block
1848cf197b54d239…
46.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.