Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · includes/Shared/assets/js/pages
2351f66a7eee45a4…
87.9 KB
MAP · includes/Shared/assets/js/pages
06d8afb2f315c1c9…
73.4 KB
MAP · includes/Shared/assets/js/pages
aa2446d65e05d469…
64.4 KB
MAP · includes/Shared/assets/js/pages
f810f8e701d2e721…
47.3 KB
MAP · includes/Shared/assets/js/pages
13fc93fd288c9e9d…
46.1 KB
MAP · includes/Shared/assets/js/pages
7f44fcec663982ae…
45.2 KB
JS · includes/Shared/assets/js/pages
5f58cd36dab79349…
31.1 KB
JS · assets/js
9a4b47886c3e82f4…
29.4 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
shell_exec
Runs an operating-system command
System command1
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.