Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MP4 · assets/vast/videos
e2a88dbcea92f6d9…
1.91 MB
SVG · webfonts
9674eb1bd5504717…
897.5 KB
SVG · webfonts
a3b9817780214caf…
730.4 KB
JS · js
ef70fd8cf5add9d2…
465.3 KB
MP4 · assets/vast/videos
45bb4352dbaf136a…
227.7 KB
MP4 · assets/vast/videos
0dc20e6e93c6c63d…
216.9 KB
MP4 · assets/vast/videos
ed03ef0f8c48b706…
213.4 KB
MP4 · assets/vast/videos
2acf72747936277c…
213.2 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
file_get_contents(url)
Fetches a remote URL
Remote request4
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.