Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/intl-tel-input/js
d2be6e5abd1bd4f4…
451.3 KB
JS · assets/intl-tel-input/js
8554df5443116eca…
301.5 KB
JS · assets/intl-tel-input/js
c86632449f1b8e32…
262.0 KB
JS · assets/intl-tel-input/js
31fb16a23b208a2c…
100.1 KB
PNG · assets/intl-tel-input/img
687d352dfcd622c7…
99.4 KB
WEBP · assets/intl-tel-input/img
d6295a13f3485862…
64.8 KB
JS · assets/admin-sms-history
c4865d17b1153c8f…
44.7 KB
JS · assets/admin-sms-prices
4030e8aedefeff99…
41.6 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
Referenced hosts
6 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.