Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · js
5f4a69127dd8c19f…
706.0 KB
JS · js
8006c9219ea563ef…
70.4 KB
JS · js
1ccbd306ef2cc51b…
68.5 KB
SVG · css/fonts
dba3aa9888fd2fac…
65.1 KB
SVG · load/fonts
4829611f47a01fd6…
61.9 KB
DB · css/images
edd5cbcc8c0ce3ff…
55.0 KB
PHP · php
69607a2bf06e681d…
49.3 KB
JS · js
b18c60ee6327f861…
45.0 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution4
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.