ploypress@2.0.0
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn } = require('child_process');
L3: const path = require('path');
High
preload.jsView file
1const { contextBridge, ipcRenderer } = require('electron');
L2:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
preload.jsView on unpkg · L1scripts/electron-builder-wrapper.jsView file
6// But ployPress is ALSO distributed as an npm[redacted] CLI
L7: // (`npm install -g ploypress-desktop`, then typing `ploypress`), where
L8: // bin/ploypress.js does `require('electron')` at runtime to find the
...
L21: const path = require('path');
L22: const { spawnSync } = require('child_process');
L23:
Findings
3 High4 Medium4 Low
HighChild Processbin/ploypress.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedrenderer/app.js
MediumDynamic Requirepreload.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ploypress@2.0.0.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.