Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · css/fonts
b8b1730c20878cd3…
512.6 KB
CSS · css
51ce56f7886e83be…
449.3 KB
MP4 · upload/construction
cf6f92f0cfbd8a17…
443.4 KB
WEBM · upload/modern
0a6da1a51068f51d…
430.3 KB
MP4 · upload/modern
1b7a9e983bd312c1…
421.1 KB
WEBM · upload/construction
da4320ab719b26ec…
389.4 KB
WEBM · upload/fitness
4075823fff45d083…
363.5 KB
MP4 · upload/fitness
b9098f8c6c4aedf9…
359.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.