Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · public/assets/lib/ink-3.1.10/dist/js
f47dec983ea387e0…
1.34 MB
JS · public/assets/lib/ink-3.1.10/dist/js
f0d7ce194c2146dd…
987.2 KB
JS · admin/assets/js/statements
a6132003f4b55fc4…
740.2 KB
TTF · includes/lib/vendor/dompdf/dompdf/lib/fonts
7da195a74c55bef9…
739.3 KB
MAP · public/assets/lib/ink-3.1.10/dist/js
61d07d81a6f38828…
715.9 KB
JS · admin/assets/js/statements
2ffdb42a4906f904…
708.0 KB
TTF · includes/lib/vendor/dompdf/dompdf/lib/fonts
e6476c1b80502924…
689.1 KB
MAP · public/assets/lib/ink-3.1.10/dist/js
c8ee6ff455738e18…
657.4 KB
Code signals
7 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution12
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation7
new Function()
Builds a function from a string
Code execution3
eval
Executes a string as code
Code execution3
unserialize
Unsafe when given untrusted input
Deserialization2
curl_exec
Makes an outbound HTTP request
Remote request1
gzinflate
Decompresses a string in memory
Obfuscation1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.