Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · skelet/assets/fonts
96b0f7509f3ac953…
705.0 KB
JSON · skelet/fields/typography
fa0aa2cf1c4b3ac0…
298.4 KB
EOT · skelet/assets/fonts
e3d21c0124262ec5…
103.2 KB
TTF · skelet/assets/fonts
5b993eed1204df7f…
103.1 KB
JS · skelet/assets/js
098a42c3c641c6e3…
79.6 KB
WOFF · skelet/assets/fonts
dabc60a138b2d656…
60.7 KB
WOFF2 · skelet/assets/fonts
838523fc3a5eddd1…
50.0 KB
JS · skelet/assets/js
8d169ec60024165a…
40.7 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
gzinflate
Decompresses a string in memory
Obfuscation1
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
16 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.