Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JSON · assets/block
18ad0008c8156222…
1000.6 KB
JS · assets/block/build
fa3370b45467a96c…
393.2 KB
MAP · assets/block/build
dbb723ca95fe81bc…
374.8 KB
JS · assets/vendor
0b695370f1100a1a…
282.0 KB
PNG · assets/img/onboarding
7c5e641aa6c98fde…
169.7 KB
JS · assets/frontend/js
14584ea5b7cfce7e…
130.1 KB
PNG · assets/img
7dbbe185fcf5a97d…
128.8 KB
JSON · inc/vendor/iconic-onboard
2977f48bb941b699…
117.1 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.