Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · includes/form
f76257177753f94c…
39.9 KB
JS · assets/js
75717c9128d65fa7…
39.1 KB
CSS · assets
17598ba22bba3ea2…
31.3 KB
SVG · assets/css
fe098badb0ac3dc1…
28.6 KB
SVG · assets/js/ui
fe098badb0ac3dc1…
28.6 KB
PHP · includes/admin
f8b8b5e6d78f0b2a…
28.5 KB
TXT · package root
5aab5c8a59e38a9b…
27.8 KB
JS · assets/js
6c110c18e84ca239…
23.8 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
11 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.