Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MP4 · chorbi/assets/videos
…
2.85 MB
WEBM · chorbi/assets/videos
…
2.85 MB
SVG · chorbi/assets/fonts
b5421eae7de37e43…
913.4 KB
MAP · chorbi/assets/bootstrap/css
2a2660058a269671…
635.5 KB
MAP · chorbi/assets/bootstrap/css
2ad3892bc61526de…
499.3 KB
SVG · chorbi/assets/fonts
7d2d9c6f8f38cdae…
434.0 KB
MAP · chorbi/assets/bootstrap/js
111450ffcc0cb723…
400.0 KB
MAP · chorbi/assets/bootstrap/js
de4a9279a8be105b…
308.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution10
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.