Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHAR · includes
f3f4f71132c3719c…
1.15 MB
MAP · admin/js
425884edb6590491…
661.9 KB
CSS · admin/css
ae19ef0069c0c1f0…
297.8 KB
MAP · public/js
dc6d6d5903d55626…
227.8 KB
JS · admin/js
0e7aa2ed01a1a9f0…
204.2 KB
JPG · public/img
ff78b0dc6fe3063a…
162.0 KB
JS · public/js
4181dde26d2ad5a8…
76.3 KB
SVG · admin/fonts
d168d50a88c730b4…
61.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.