Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · vendor/cmb2/cmb2
63c2b9a568e2b712…
146.4 KB
TXT · vendor/cmb2/cmb2
f9ae5fdb73b4bc2f…
107.2 KB
MD · vendor/cmb2/cmb2
e5ddd69a1d3640be…
85.2 KB
JS · vendor/cmb-field-select2/js
fa659dfc6ebd4b8a…
65.1 KB
PHP · vendor/cmb2/cmb2/includes
222912fe72d9bf66…
52.9 KB
CSS · vendor/cmb2/cmb2/css
430039b7dd9d615f…
49.4 KB
CSS · vendor/cmb2/cmb2/css
daf6a3f7aa0df881…
49.4 KB
PHP · vendor/cmb2/cmb2/includes
bf21ceeafd03c456…
45.8 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.