Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PHP · provider/freemius/includes
cb7063cffd6330d5…
997.2 KB
SVG · css/font-awsome/fonts
ad6157926c1622ba…
434.0 KB
TTF · assets_libraries/font-awesome6
fbbf06d7437aa30f…
409.9 KB
JS · js/codemirror-custom
9dc442d2c67ae928…
392.4 KB
JS · js/codemirror-custom
e5f4ccd3b47529c7…
388.9 KB
SVG · assets_libraries/font-awsome/fonts
6b0adce775f4d57a…
381.3 KB
JS · js/html2canvas
8c9a7cda108ab624…
323.4 KB
TXT · package root
0d51ac462b276b0f…
314.2 KB
Code signals
8 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval
Executes a string as code
Code execution9
eval (JavaScript)
Executes a string as code
Code execution6
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation6
unserialize
Unsafe when given untrusted input
Deserialization4
assert
Can execute a string as code on old PHP
Code execution1
gzinflate
Decompresses a string in memory
Obfuscation1
new Function()
Builds a function from a string
Code execution1
file_get_contents(url)
Fetches a remote URL
Remote request1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.