Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · hotely/assets/js
26b8b7c21194d07f…
1.18 MB
JPG · hotely/assets/images
b4632f7f2502a466…
822.4 KB
JPG · hotely/assets/images
b60df2af13b31aee…
420.1 KB
SVG · hotely/assets/fonts
8e3586389bb4cd01…
382.4 KB
JPG · hotely/assets/images/places
5f2da6e05c9012b2…
381.3 KB
JPG · hotely/assets/images/authorlist
411e535b45e085f2…
358.2 KB
JPG · hotely/assets/images/places-videos
fc3d2987a51bd4c3…
358.0 KB
SVG · hotely/assets/fonts
5ba9d1e3416f6669…
328.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.