ploypress
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
This report shows the evidence for ploypress@2.4.1. 0 of 12 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime telemetry by default, including usage details beyond basic package and runtime metadata, without an identified disclosure or opt-out. The destination is the package’s own licensing host and the SSH host is reduced to a provider label, so the evidence supports suspicious telemetry rather than data exfiltration.
Decision evidence
public snapshot- Normal app startup sends an app_launched usage ping and a once-per-launch heartbeat.
- Ping payloads include an install ID and version, with optional license key and event metadata.
- Completed syncs send the license key and operation details, including an SSH target label.
- Pings go to the package’s licensing host; the SSH label is derived from the configured host or alias.
- The endpoint belongs to ployPress, and the code describes its pings as anonymous usage reporting.
- The SSH value is reduced to a provider category rather than sending the raw host.
- The SSH key setup and backup scheduler behavior appear tied to user actions or enabled settings.
Source & flagged code
11 flaggedFindings
Affected versions and remediation
This report applies to ploypress@2.4.1.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of ploypress@2.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.