Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · includes/listing/builder/assets/js
1728fde8b25af974…
1.91 MB
JS · admin/assets/js
a8a69c214a1a5f18…
450.8 KB
JS · framework/vue-ui/assets/js
352baa818da10992…
334.1 KB
JS · framework/vue-ui/assets/js
06d28313eb95891a…
295.6 KB
JS · assets/js
fb2b20fc838e7c24…
189.1 KB
JS · assets/js
e85ed0b393f1e69f…
171.1 KB
POT · languages
bf0e6d82f893e1d4…
139.6 KB
MAP · framework/blocks-style-manager/assets/build
55522b633e87d656…
120.5 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution10
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.