Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · node_modules/uglify-js/lib
52e96fcca1a6ad99…
639.1 KB
JS · node_modules/lodash
4c04561befdf653a…
531.3 KB
JS · node_modules/esprima/dist
6c36c0e60387f539…
276.9 KB
PEM · vendor/composer/ca-bundle/res
b6e66569cc3d438d…
220.9 KB
JS · node_modules/async/dist
9f42975430301fd7…
219.6 KB
MJS · node_modules/async/dist
b16dfa501a9e86dc…
195.6 KB
JSON · node_modules/uglify-js/tools
181cf4986ae50444…
179.3 KB
JSON · package root
25a3f078377a5337…
130.7 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution11
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.