Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
PNG · images
417d42fc501bff69…
219.1 KB
MAP · js/built
5fb4fd659e3057f1…
127.1 KB
MAP · js/built
a4c32367fc145e74…
112.5 KB
TS · js/src
de108c5f997596ce…
53.2 KB
JS · js/built
7699851a9d6e5b09…
32.4 KB
PHP · package root
f49dcbe3651dbb3a…
29.1 KB
JS · js/built
8824d492ef36efac…
28.8 KB
MAP · js/built
3c52d2446cc8212b…
18.7 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution2
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.