Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
CSS · package root
98193543d046c1bb…
564.8 KB
SVG · assets/font-awesome-4.7.0/fonts
fc378232f9dad500…
436.6 KB
SVG · assets/minify-font-icons/font-awesome-4.7.0
fc378232f9dad500…
436.6 KB
TTF · assets/font-awesome-6/webfonts
fbbf06d7437aa30f…
409.9 KB
TTF · assets/captcha-fonts
4044aa6b5bebbc36…
279.9 KB
PO · languages
f34e8c74653470d2…
239.4 KB
PO · languages
d0ab77e765b3811a…
229.5 KB
PO · languages
d5af0c1e41670abd…
227.6 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution2
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.