Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/libs/jspdf
20b0b3ea2b7596f9…
352.8 KB
PEM · core/integrations/payment/ipn/cert
1c877515ac2a92a5…
255.5 KB
JS · build/frontend/form-builder
c460ff464070b791…
253.8 KB
JS · assets/libs/html2canvas
763fdb8633099ce3…
193.9 KB
PNG · build/assets/images
8ab4e961a71e2a40…
170.3 KB
PNG · build/assets/images
0a012cf808a24573…
69.2 KB
POT · languages
ee8ee26c9adedf74…
65.7 KB
CSS · build/frontend/form-builder
dc8372c7f4acaa35…
64.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
curl_exec
Makes an outbound HTTP request
Remote request1
eval
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.