Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · RockGroupHTML_1.5/images/custom
…
3.62 MB
JPG · RockGroupHTML_1.5/images/custom
f43333dae0a8a3e4…
722.1 KB
JPG · RockGroupHTML_1.5/images/custom
f3798bf7a95e6e42…
675.1 KB
JPG · RockGroupHTML_1.5/images/custom
d1f5f9d369034b0e…
590.8 KB
JPG · RockGroupHTML_1.5/doc/images
4bbbf28243a915c0…
396.8 KB
JPG · RockGroupHTML_1.5/images/custom
21edd1eb09b59a87…
336.0 KB
PNG · RockGroupHTML_1.5/images/scene
7442648fe62b0a19…
309.5 KB
PNG · RockGroupHTML_1.5/images/scene
fa8810252b44d407…
306.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.