Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
TXT · admin/vendors/cmb2
b56b444a5fdb8c98…
80.1 KB
JS · admin/vendors/cmb-field-select2/js
fa659dfc6ebd4b8a…
65.1 KB
MD · admin/vendors/cmb2
4b4cb5baf5bd0617…
63.8 KB
LOCK · package root
148f63d06ace41e5…
63.6 KB
PHP · admin/vendors/cmb2/includes
9c2f2f13384c24d5…
49.2 KB
CSS · admin/vendors/cmb2/css
74d92c5e685e5bc6…
47.8 KB
CSS · admin/vendors/cmb2/css
7d381bbd0a740678…
47.8 KB
CSS · admin/vendors/cmb2/css
7068194aac639915…
46.4 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.