ploypress@2.3.10
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the flagged credential flow is activated by an explicit user action and targets the selected SSH server. The inspected CLI, shell, and build-wrapper behavior does not establish a separate attack surface.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user enters a server password and clicks the key installation button.
Impact
The selected account gains key-based access for that public key. The inspected source does not establish a package-selected credential recipient or an unrelated attack surface.
Mechanism
The app sends the password and public key over SSH to the supplied host and adds the key to that account's authorized_keys; the password field is cleared after the request.
AI rationale
The package has no install lifecycle hook, and the flagged credential flow is activated by an explicit user action and targets the selected SSH server. The inspected CLI, shell, and build-wrapper behavior does not establish a separate attack surface.
Evidence
src/sshSetup.jsmain.jsrenderer/app.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines the app entrypoint and has no preinstall, install, or postinstall hook.
- The SSH helper runs the supplied public key on the selected server and passes the password to an SSH connection configured with the supplied host, port, and user.
- The renderer sends the password only from the install button handler, with the selected server details, and clears the password field afterward.
- The main process routes that request to the SSH helper; the flagged shell excerpt formats command errors for display.
- The CLI launches the Electron app, and the build wrapper temporarily relocates the Electron dependency for packaging.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedsync-files-test.jsView file
271patternName = generic_password
severity = medium
line = 271
Medium
277patternName = generic_password
severity = medium
line = 277
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High6 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/sshSetup.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsync-files-test.js
Affected versions and remediation
This report applies to ploypress@2.3.10.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.