Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · build
2cce3e3fd2c888ac…
60.6 KB
GIF · vendor/codexpert/plugin/src/assets/img
89536689caf42a11…
47.5 KB
PHP · vendor/codexpert/plugin/src
dfa67c8303cf2199…
26.5 KB
WEBP · vendor/codexpert/plugin/src/assets/img
585f8bdae0e47098…
26.0 KB
GIF · assets/img
a3b15548abedc375…
19.9 KB
PNG · vendor/codexpert/plugin/src/assets/img
9fc6cac977feba6b…
18.8 KB
PHP · vendor/pluggable/plugin/src
0d94caebd7b48800…
18.7 KB
PHP · vendor/codexpert/plugin/src
e84a38c002ab4818…
18.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
16 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.