Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · vendor/freemius/includes
c097c3acce21dfe8…
995.4 KB
JS · vendor/freemius/assets/js/pricing
10ad36eab47fd74f…
290.5 KB
JS · assets/premium/dist
e011d460cb8a10d0…
289.8 KB
JSON · assets/premium/dist
007be1b2e7d15785…
271.4 KB
JS · assets/premium/dist
3dbb734b0fda8fbb…
232.8 KB
JS · assets/premium/dist
a61a99468b9e3ae3…
209.4 KB
PO · languages
06a4e69de6c0fe45…
190.5 KB
JS · assets/premium/dist
6f2d24bac12448c1…
140.8 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
new Function()
Builds a function from a string
Code execution3
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.