Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPEG · assets/images
e35c9e5756687e06…
1.47 MB
PNG · assets/images
6ee004c52799136a…
1.14 MB
JPEG · assets/images
019654f289dda931…
1023.0 KB
JPEG · assets/images
9e12382f9634de78…
986.2 KB
JPEG · assets/images
1c9a457dec775acc…
966.9 KB
JPEG · assets/img
b37a970e4a9afc59…
842.8 KB
PNG · assets/images
3846a7480105c5c6…
806.8 KB
PNG · assets/images/demo
3846a7480105c5c6…
806.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution6
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.