ploypress@2.3.5
⚠ Under reviewPush, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedsync-files-test.jsView file
150patternName = generic_password
severity = medium
line = 150
matchedText = producti...} },
Medium
156patternName = generic_password
severity = medium
line = 156
matchedText = password...ss',
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High6 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltamain.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/sshSetup.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedrenderer/app.js
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsync-files-test.js
Affected versions and remediation
This report applies to ploypress@2.3.5.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.3.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.