Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MUSE · Muse
…
7.06 MB
SVG · Html/qoni/fonts
8e3586389bb4cd01…
382.4 KB
PDF · package root
8bb3a7a5fdb6d0f9…
283.5 KB
SVG · Html/qoni/fonts
293d041046ae36a6…
175.2 KB
HTML · Html/qoni
220cdc1ff0d7c297…
126.6 KB
CSS · Html/qoni/css
6048b04b8264ff7d…
96.5 KB
JS · Html/qoni/scripts
ba6eda7945ab8d7e…
91.4 KB
WOFF · Html/qoni/fonts
adbc4f95eb6d7f27…
88.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.