Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · assets/fonts
57a8aa7d3d3ac802…
775.4 KB
SVG · assets/fonts
e2b365cd3cffb2fc…
732.2 KB
PNG · assets/images
6782a5d6402b991e…
631.4 KB
SVG · assets/fonts
29805d4f3e254194…
518.3 KB
EOT · assets/fonts
ad6d480e74a3165f…
386.1 KB
TTF · assets/fonts
1be784572fd278e5…
386.0 KB
CSS · assets/css
7e8a42dbcee58ba2…
339.1 KB
PNG · assets/images
b168bc7af4228e0b…
325.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution8
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.