Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JPG · source/assets/img/shape
ef21831673326fd4…
1.93 MB
PNG · source/assets/img/illustration
2737248eaade1f69…
1.06 MB
PNG · source/assets/img/illustration
d8ea6385594cf539…
946.9 KB
TTF · source/assets/fonts
863a79a9ffeb4d49…
901.5 KB
TTF · source/assets/fonts
8284caa6e04d2162…
869.8 KB
TTF · source/assets/fonts
2b72c05aed775545…
815.1 KB
TTF · source/assets/fonts
b466481df694f2c1…
724.1 KB
TTF · source/assets/fonts
db04c49278de66fe…
633.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution8
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.