Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · assets/dist/js
b7357e48779a4be9…
1.00 MB
CSS · assets/dist/css
186e9067e0107043…
694.2 KB
JSON · assets
132edf61423bac97…
456.8 KB
SVG · assets/images
210da2c65e138b75…
250.7 KB
JS · assets/dist/js
f826cf9dc635b568…
214.2 KB
CSS · assets/dist/css
e3c3e44e64f6915c…
187.2 KB
CSS · assets/dist/css
0f7e080d89a67d39…
186.5 KB
JS · assets/dist/js
f12e3157721df428…
154.3 KB
Code signals
2 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
new Function()
Builds a function from a string
Code execution3
unserialize
Unsafe when given untrusted input
Deserialization3
Referenced hosts
15 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.