Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MP4 · myclean/video
d2c1bd1f2affdccf…
1.92 MB
SVG · myclean/fonts
7db8bd0c2130a7ef…
985.2 KB
JS · myclean/js
00ccf5daddc07788…
506.2 KB
MAP · myclean/css
daa4aebc002864fc…
372.1 KB
SVG · myclean/fonts
d67041fe5d50eef9…
357.0 KB
EOT · myclean/fonts
72da15ef28301c2f…
294.5 KB
WOFF · myclean/fonts
b86ec18463dc3814…
294.4 KB
TTF · myclean/fonts
ae2fad78c476a254…
294.3 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.