Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
MAP · layouts/assets/js/min
89728ea4a5df4766…
325.9 KB
LOCK · layouts
9a491991d30ec283…
124.2 KB
JS · layouts/assets/js/builder/controllers
28a33fcd0dbd3212…
87.5 KB
JS · layouts/assets/js/min
29491c271e7e31f6…
83.9 KB
PHP · styles
b5b6ae7426a110d4…
71.9 KB
MAP · layouts/assets/css
aa3c9322ffdd319e…
51.4 KB
MAP · layouts/assets/js/min
a8db3cfe5840fa33…
38.6 KB
JS · styles/assets/js
f138029bb45c9538…
26.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization1
Referenced hosts
3 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.