Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
SVG · assets/css/fonts
a5d4cef975ebe67a…
513.8 KB
SVG · assets/css/fonts
cfd4334a470090e1…
397.2 KB
PHP · includes
2be6d26bb1bffdd0…
232.9 KB
JS · assets/js/libs
c85e670d8b7557e0…
153.1 KB
JS · assets/js
75ea47adda0048d9…
127.2 KB
PHP · includes
b635424418ee6a0f…
114.9 KB
SVG · assets/css/fonts
67c40d7ec3185ad4…
111.1 KB
EOT · assets/css/fonts
8b4e1b847e22233d…
103.5 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution1
Referenced hosts
7 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.