Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/js
…
3.19 MB
SVG · assets/fonts
ad6157926c1622ba…
434.0 KB
JS · assets/js/lib
db79104483b5086b…
375.0 KB
JSON · assets/data
dff9b56b19892bd3…
343.7 KB
JS · assets/js/lib
28ce75d953678c49…
247.7 KB
TTF · assets/fonts/text-fonts
1b43de2449d39b65…
219.2 KB
TTF · assets/fonts/text-fonts
b4c2050b25d3d296…
216.0 KB
TTF · assets/fonts/text-fonts
13c03e22a633919b…
212.2 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
atob
Decodes base64 in the browser
Obfuscation1
Referenced hosts
13 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.