Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js
a74163d821bb41e3…
49.3 KB
CSS · assets/css
d09221060fd5e401…
39.5 KB
JS · assets/js
dbabe5918caafa4b…
21.6 KB
PHP · src/Provider/Settings
43f794cb3fce9425…
21.0 KB
PHP · src/Provider
c1efd7bd43620efa…
20.1 KB
CSS · assets/css
d06eb02cc77a2881…
19.4 KB
PHP · vendor/composer
c944c4b1228ef6be…
15.7 KB
PHP · src/Admin
1c536704c11b31db…
15.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
9 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.