Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js/tinymce
c455ef0cbdef93dd…
391.8 KB
PHP · package root
60937b7ecc3f7f75…
278.6 KB
PNG · assets/images
b1d07897a20fe652…
177.3 KB
JS · assets/select2/js
097ea4c03a201ef7…
164.3 KB
JS · assets/js
4efaedb6ef12e0f7…
158.9 KB
MAP · assets/js
085d51323cc2e6bd…
148.5 KB
JS · assets/select2/js
f66aca0c132d23be…
144.2 KB
JS · assets/js
037e64fc78a41804…
83.6 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation5
atob
Decodes base64 in the browser
Obfuscation2
curl_exec
Makes an outbound HTTP request
Remote request1
Referenced hosts
19 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.