ploypress@2.3.12
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged persistence behavior is an explicit SSH key setup feature directed at a user-selected server. The scanner’s risk labels do not establish a package attack in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user clicks the key installation button and enters the server password.
Impact
The selected key can authenticate to the server account; the password is used for that connection and cleared from the input afterward.
Mechanism
The app connects to the selected SSH host and appends the supplied public key to that account’s authorized_keys file.
AI rationale
The manifest has no install lifecycle hook, and the flagged persistence behavior is an explicit SSH key setup feature directed at a user-selected server. The scanner’s risk labels do not establish a package attack in the inspected source.
Evidence
~/.ssh/known_hostsremote ~/.ssh/authorized_keys~/.ploypress/runtime/<version>/ployPress.app
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install lifecycle hook; its bin entry launches the CLI.
- The SSH key installation runs only after the user clicks the install button and supplies a password; the password is sent to the selected host and then cleared.
- The SSH command adds the selected public key to that server’s authorized_keys; it does not install a backdoor on the consumer machine.
- The CLI prepares a branded Electron runtime in the user’s .ploypress directory, and the build wrapper temporarily adjusts the Electron dependency for electron-builder before restoring package.json.
- The shell helper spawns the command and arguments it receives as part of the app’s command-running API.
Evidence against
- The scanner flagged persistence and reachable dangerous behavior in src/sshSetup.js, but inspected source shows a user-triggered SSH key setup feature.
- The SSH connection accepts the host key after a known-host lookup or first-use key scan; no separate attack behavior was established from this flow.
Behavioral surface
ChildProcess
Source & flagged code
10 flaggedsync-files-test.jsView file
271patternName = generic_password
severity = medium
line = 271
Medium
277patternName = generic_password
severity = medium
line = 277
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High6 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/sshSetup.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedrenderer/app.js
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsync-files-test.js
Affected versions and remediation
This report applies to ploypress@2.3.12.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.3.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.