Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · assets/fonts
9674eb1bd5504717…
897.5 KB
SVG · assets/fonts
a3b9817780214caf…
730.4 KB
JS · assets/blocks/dist
750dea61abe1e40d…
298.1 KB
EOT · assets/fonts
373c04fd2418f5c7…
198.3 KB
TTF · assets/fonts
af6397503fcefbd6…
198.0 KB
SVG · assets/fonts
be0a084962d80668…
141.3 KB
JS · assets/blocks/src/components
24c72d8aebd3143b…
140.2 KB
EOT · assets/fonts
e4299464e7b01296…
131.1 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.