Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/editor/dist/lazy-chunks
…
4.49 MB
JS · assets/editor/dist/lazy-chunks
…
2.92 MB
JS · assets/editor/dist
13bd9b5a98e32789…
1.58 MB
JPG · assets/editor/img/layer
5eb793b61dea1ae3…
824.1 KB
JS · assets/fonts
91a0f19a3f57171e…
644.0 KB
CSS · assets/editor/dist
0581c5b874b6d690…
201.2 KB
SVG · assets/images
b4e8b25d4a89ada7…
23.8 KB
POT · languages
c66ff49e1e14445f…
21.7 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
atob
Decodes base64 in the browser
Obfuscation1
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
17 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.