ploypress@2.3.3
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe flagged SSH behavior is an explicit server setup action using a password entered for that server. The manifest has no npm install lifecycle hook, and the inspected CLI and build wrapper perform application launch and build tasks.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user clicks the SSH key installation button and enters the server password.
Impact
The selected server accepts the corresponding key for future SSH authentication; no unrelated credential transfer or hidden persistence was found.
Mechanism
The application authenticates to the supplied server and appends the selected public key to its authorized keys file.
AI rationale
The flagged SSH behavior is an explicit server setup action using a password entered for that server. The manifest has no npm install lifecycle hook, and the inspected CLI and build wrapper perform application launch and build tasks.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to the application and CLI and lists no npm install lifecycle hook.
- The SSH key setup is exposed through a visible button; clicking it sends the entered password and selected server details for a one-time operation.
- The remote command adds the chosen public key to that server’s authorized keys file, and the connection uses the supplied host, port, user, and password.
- The CLI launches the application, and the build wrapper restores the package manifest after running the build tool.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedsync-files-test.jsView file
150patternName = generic_password
severity = medium
line = 150
Medium
156patternName = generic_password
severity = medium
line = 156
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High6 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/sshSetup.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedpackage.json
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsync-files-test.js
Affected versions and remediation
This report applies to ploypress@2.3.3.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.