Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · layouts/assets/js/min
b332a011634ec813…
319.9 KB
LOCK · layouts
c9ad9300031fcbb8…
124.2 KB
JS · layouts/assets/js/builder/controllers
8e1320aed479c6fc…
83.2 KB
JS · layouts/assets/js/min
249adbd3f668b0c9…
82.8 KB
PHP · styles
26f54ecf636ccb35…
66.9 KB
MAP · layouts/assets/css
aa3c9322ffdd319e…
51.4 KB
MAP · layouts/assets/js/min
a8db3cfe5840fa33…
38.6 KB
JS · styles/assets/js
a5066b45e4ddd997…
26.1 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
3 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.