Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · js/built
a78319730c28f635…
169.1 KB
MAP · js/built
e43769756d0b62af…
158.2 KB
PHP · package root
90b765607423249b…
152.1 KB
TXT · package root
1f1fc909a295edc7…
75.9 KB
JS · js/built
29249a9f5d7abeff…
66.3 KB
TS · js/src
db9a4fa8ef07ec07…
60.7 KB
JS · js/built
c6ae54fac89a183a…
41.6 KB
MAP · js/built
fb834603e94b13e0…
32.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
eval
Executes a string as code
Code execution1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.