Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · listany/fonts
a627d9068c1235d9…
326.0 KB
SVG · listany/fonts
bfdef833219a6edf…
306.1 KB
SVG · listany/fonts
f7af2e096c85c2ed…
228.8 KB
CSS · listany/stylesheets
5676049715b079a6…
187.1 KB
TTF · listany/fonts
2ba7f20b1d8990e1…
184.1 KB
SVG · listany/fonts
663d8ece1e27d7e8…
171.4 KB
CSS · listany/revolution/css
9b6f1b228efaa76b…
143.7 KB
JPG · listany/images/parallax
e60cc8cba66f542c…
143.2 KB
Code signals
4 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
curl_exec
Makes an outbound HTTP request
Remote request1
eval (JavaScript)
Executes a string as code
Code execution1
atob
Decodes base64 in the browser
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.