Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets
46b40b61c94928ad…
1.48 MB
JS · feat/block/dev
f70be44905c6293c…
759.3 KB
MAP · feat/block/dev
139ba1a77fc92faf…
645.9 KB
JS · admin/settings/assets
74574ab65301764d…
204.3 KB
MAP · admin/settings/assets
910c28edc1a07247…
196.6 KB
JS · assets
9c179331e6db86cb…
191.3 KB
JS · feat/block/dist
c5fd795c7adbcc55…
97.9 KB
PHP · package root
9dc812a00938bb6d…
48.9 KB
Code signals
1 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
eval (JavaScript)
Executes a string as code
Code execution69
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.