ploypress@2.1.0
⚠ Under reviewPush, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn } = require('child_process');
L3: const path = require('path');
High
erase-test.jsView file
5// npm run test-erase
L6: const os = require('os');
L7: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
erase-test.jsView on unpkg · L5scripts/electron-builder-wrapper.jsView file
6// But ployPress is ALSO distributed as an npm[redacted] CLI
L7: // (`npm install -g ploypress-desktop`, then typing `ploypress`), where
L8: // bin/ploypress.js does `require('electron')` at runtime to find the
...
L21: const path = require('path');
L22: const { spawnSync } = require('child_process');
L23:
Findings
1 Critical3 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedrenderer/app.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ploypress@2.1.0.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.