Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · public/build/directory-map
1ea39c7da59b8c5e…
198.9 KB
JPG · public/images
88351ddf8c0bbcd3…
182.6 KB
PHP · app/controllers
8857ba3d5d14c56f…
87.1 KB
POT · i18n
a523885e76bbc96c…
80.7 KB
PHP · app/lib
cf4ec6cbed338fb6…
58.9 KB
JS · public/build/directory-social-icons
44676a519be400c9…
58.3 KB
JS · public/build/directory-user-template
eaa1c7fa6f86ab50…
57.4 KB
JS · public/build/profile-photo
dc258e12299eef9a…
56.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
atob
Decodes base64 in the browser
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.