Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · includes/react-widget/build
25b96c2ed166e687…
1.22 MB
JS · includes/react-widget/build
ccfcc5cd1e7319b4…
670.5 KB
JS · includes/react-widget/build
9c0a78e133400cd7…
530.4 KB
JS · assets/js
91e75dde71ab833a…
477.6 KB
JS · assets/js
f15391e94c281041…
329.1 KB
JS · assets/js
0658d24126717804…
308.1 KB
JS · assets/js
58d7b3cb588a725b…
304.9 KB
JS · includes/react-widget/build
d4311f9b7816a5ff…
287.7 KB
Code signals
6 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
unserialize
Unsafe when given untrusted input
Deserialization8
new Function()
Builds a function from a string
Code execution8
curl_exec
Makes an outbound HTTP request
Remote request2
atob
Decodes base64 in the browser
Obfuscation2
base64_decode
Decodes base64 — routine, but also how packed code hides
Obfuscation1
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.