Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · public/js/build
b135675690091d0b…
282.5 KB
JS · public/js/vendor
9bd694a723405aee…
71.4 KB
PHP · app/controllers
f8a8bc800b05961a…
61.7 KB
POT · i18n
e2a08dc67cb6e187…
49.2 KB
PNG · public/images
f6e462cad31a2574…
45.4 KB
CSS · public/css/build
2d7d12bbc70f0b7c…
44.1 KB
PHP · app/lib
8b1a44a65be7df01…
41.5 KB
JS · public/js/vendor
5401f62a90216b82…
40.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
atob
Decodes base64 in the browser
Obfuscation1
Referenced hosts
10 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.