Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · zunzo/javascript
6e00bfa8d8d66198…
957.7 KB
HTML · zunzo
ccae70733e34eddc…
212.8 KB
SVG · zunzo/fonts
293d041046ae36a6…
175.2 KB
JS · zunzo/javascript
8f7d07f014d89eb9…
168.6 KB
HTML · zunzo
779fbee9542718ad…
153.3 KB
CSS · zunzo/stylesheets
88422212bac9bae0…
152.3 KB
CSS · zunzo/stylesheets
7633b7c0c97d19e6…
152.2 KB
HTML · zunzo
3d99622797a9ddd8…
145.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.