Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · js/built
a78319730c28f635…
169.1 KB
MAP · js/built
843a71571e2c6969…
156.7 KB
PHP · package root
6ee297478df08b56…
144.7 KB
TXT · package root
0cf4a41af1c91e83…
75.0 KB
JS · js/built
29249a9f5d7abeff…
66.3 KB
TS · js/src
7a3ee5f3bc7b4033…
59.5 KB
JS · js/built
5809a729f900a737…
41.5 KB
MAP · js/built
d8abdcd2ea46b6c2…
31.9 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
eval
Executes a string as code
Code execution1
Referenced hosts
14 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.