Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · yolo/images/parallax
…
2.00 MB
JPG · yolo/images/photography
60517d620c2e35f3…
1.97 MB
JPG · yolo/images/revolution
15fa8bddf1f8fb4b…
1.90 MB
JPG · yolo/images/parallax
8771de837f054284…
1.89 MB
JPG · yolo/images/revolution
31a30a7aea36c217…
1.88 MB
JPG · yolo/images/revolution
b821dd030155c727…
1.88 MB
JPG · yolo/images/parallax
e2267a65b802c8ce…
1.88 MB
JPG · yolo/images/revolution
d110b7b1d5f5f4c7…
1.87 MB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
curl_exec
Makes an outbound HTTP request
Remote request1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.