Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · assets/fonts
4a7c37b1f26fc87b…
751.2 KB
JS · assets/blocks/responsive-text
dbba9213f44e9b5e…
594.5 KB
JS · assets/blocks/page-title
72e519986d147326…
593.8 KB
MAP · assets/blocks/cluster
0918f786d31e0649…
323.2 KB
INC · vendor/less
a7ecd0af195207bb…
254.5 KB
JS · assets/vendor/fontawesome-iconpicker
c1965ef3b77cb99f…
131.1 KB
PO · languages
5a7f209e1c3eb018…
118.2 KB
PO · languages
e7fca478bb52a978…
112.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
16 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.