Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · assets/icons
19292c42cc29af96…
278.9 KB
JS · assets/js
57d15b3dbe0cb11d…
192.7 KB
SVG · assets/icons/fonts
c4ac10e80c977a9e…
173.5 KB
JS · inc/assets/js
097ea4c03a201ef7…
164.3 KB
CSS · assets/css
23798a5be5668440…
162.1 KB
CSS · inc/assets/css
8fedef45ea3049ab…
161.6 KB
CSS · assets/css
ed229a57e697e1ee…
79.5 KB
CSS · inc/assets/css
ed229a57e697e1ee…
79.5 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization2
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.