Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · public/assets/fancybox
bc1affae98bd65d8…
28.2 KB
JS · public/assets/js
a095a302f9cb0b5a…
28.1 KB
JS · public/assets/fancybox
cee70622e3e4a06d…
27.6 KB
JS · public/assets/fancybox
596904dd33536d79…
21.1 KB
PHP · public
2673063c02e305ee…
19.4 KB
PHP · packages/composer
1e4525198301d1ed…
17.0 KB
PHP · packages/composer
d4b2313e562edf94…
16.0 KB
PNG · public/assets/fancybox
324b9d944e39c915…
14.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution1
Referenced hosts
12 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.