ploypress@2.3.11
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms an explicit remote SSH key-install feature and no automatic npm lifecycle execution. The capability is dangerous if misused, but the inspected code does not establish malicious or unconsented execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes the SSH key-install action from the application and supplies host, account password, and public key.
Impact
A supplied key gains future passwordless access to the specified remote account.
Mechanism
Append a public key to the remote account's SSH authorized_keys file.
AI rationale
Source inspection confirms an explicit remote SSH key-install feature and no automatic npm lifecycle execution. The capability is dangerous if misused, but the inspected code does not establish malicious or unconsented execution.
Evidence
main.jssrc/sshSetup.js~/.ssh/authorized_keys~/.ssh/known_hosts
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The application can append a supplied SSH public key to a remote server's authorized_keys file, creating persistent remote access when its key-install action is invoked.
- The key-install capability is exposed through the Electron main-process IPC handler.
- The release wrapper invokes npx electron-builder, which is a build/release action rather than package installation.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- The SSH action is reachable through a named IPC operation, not automatically during npm installation.
- The CLI launches the bundled Electron application; it does not install packages or alter SSH keys.
- The manifest declares ordinary application dependencies and no dependency on ploypress itself.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
10 flaggedsync-files-test.jsView file
271patternName = generic_password
severity = medium
line = 271
Medium
277patternName = generic_password
severity = medium
line = 277
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High6 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/sshSetup.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsync-files-test.js
Affected versions and remediation
This report applies to ploypress@2.3.11.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.3.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.