Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
139635e971da8df6…
380.7 KB
JS · vendors/js
df178d935914fb63…
121.8 KB
JS · vendors/js
babc72124754e05f…
69.8 KB
CSS · css
8326fcc140379a9f…
67.8 KB
POT · package root
12895bd14ebaf106…
52.0 KB
CSS · vendors/css
e2ae7fcb36fab919…
48.5 KB
CSS · css
8e00e4c42856893c…
46.6 KB
JS · vendors/js
aa01bd1c9a95c711…
44.1 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.