Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/vendors/videojs/alt
8c663345e18091e2…
207.9 KB
MAP · assets/libs/bootstrap-4.1.3/js
0a9b1af0e8ba7a80…
207.0 KB
JPG · assets/img
08414b86d61fcbc6…
198.0 KB
JPG · assets/img
034f5420597921a7…
197.1 KB
JPG · assets/img
13b68e1fc1f01443…
196.4 KB
JPG · assets/img
86f5125ac6f39828…
194.6 KB
JPG · assets/img
a1f4648ed6b62541…
192.3 KB
JS · assets/plugins/slider-pro/dist/js
1b08f607aa39c494…
188.2 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation3
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.