Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · Template/jano/images/assets
…
2.93 MB
SVG · Template/jano/images/assets
0b2f8a70757660ee…
571.4 KB
SVG · Template/jano/images/icon
88ed5ee2f2fb0e2f…
548.9 KB
SVG · Template/jano/images/icon
897e38bd94e813d1…
532.1 KB
SVG · Template/jano/images/assets
d959bfc0ad816bbb…
507.6 KB
SVG · Template/jano/images/assets
1471ef8bef45ba69…
507.6 KB
SVG · Template/jano/images/icon
f70b637353102578…
471.8 KB
SVG · Template/jano/images/icon
2c3fb553f51d6fae…
442.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.