Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js
c2eb830bea6f72ce…
76.6 KB
POT · languages
e37432d2892983ee…
65.3 KB
CSS · assets/css
ed587aaf0850e872…
59.3 KB
PO · languages
13a3e36e1f33dba2…
57.3 KB
PO · languages
109d449e80da226b…
56.7 KB
PO · languages
8833ffcdf1407e2a…
56.5 KB
PO · languages
7d8480b6bfc17d98…
56.3 KB
CSS · assets/css/minified
e0d8cf22735e7d9c…
55.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
Referenced hosts
18 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.