Individual filenames are withheld. Each entry shows its type, its folder within the package and its own SHA-256.
JS · admin/assets/js/ace
adf37dc54d042dcb…
357.9 KB
PHP · inc/scssphp/src
34627a4fb7181c23…
308.1 KB
JS · admin/assets/js/ace
017c5d99f56f3429…
211.8 KB
JS · admin/assets/js
0f6b6487fdc444ea…
189.4 KB
MAP · assets/es-js
c5936b1ed355abed…
167.6 KB
JS · admin/assets/js/ace
4d3601707c9ca571…
137.2 KB
PNG · admin/assets/js
dba8e0dfbd5f5479…
120.0 KB
JS · assets/es-js
435fd777d5d87815…
117.5 KB
Code signals
3 present
Observations, not findings. Every construct below appears in ordinary, legitimate plugins — they are listed so you can judge for yourself. Only ClamAV decides this package's verdict.
assert
Can execute a string as code on old PHP
Code execution67
eval (JavaScript)
Executes a string as code
Code execution5
unserialize
Unsafe when given untrusted input
Deserialization2
Referenced hosts
20 distinct
Domains appearing in the package source. Most are documentation links or CDNs; their presence is not evidence the package contacts them.