ploypress@2.4.1
Push, pull and promote WordPress sites between local, staging and production — files and database, with backups and pre-flight safety checks.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package sends runtime telemetry by default, including usage details beyond basic package and runtime metadata, without an identified disclosure or opt-out. The destination is the package’s own licensing host and the SSH host is reduced to a provider label, so the evidence supports suspicious telemetry rather than data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
App startup sends launch and heartbeat events; successful syncs send deploy events.
Impact
The vendor can associate usage patterns with an install and, for paid users, a license key; the code does not disclose this telemetry or provide an identified opt-out.
Mechanism
The app posts an install ID, version, and event metadata. Sync events can include a license key, operation details, and an SSH target reduced to a hosting-provider label.
AI rationale
The package sends runtime telemetry by default, including usage details beyond basic package and runtime metadata, without an identified disclosure or opt-out. The destination is the package’s own licensing host and the SSH host is reduced to a provider label, so the evidence supports suspicious telemetry rather than data exfiltration.
Evidence
main.jssrc/usage.js
Network endpoints1
license.ploypress.com/ping.php
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Normal app startup sends an app_launched usage ping and a once-per-launch heartbeat.
- Ping payloads include an install ID and version, with optional license key and event metadata.
- Completed syncs send the license key and operation details, including an SSH target label.
- Pings go to the package’s licensing host; the SSH label is derived from the configured host or alias.
Evidence against
- The endpoint belongs to ployPress, and the code describes its pings as anonymous usage reporting.
- The SSH value is reduced to a provider category rather than sending the raw host.
- The SSH key setup and backup scheduler behavior appear tied to user actions or enabled settings.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
11 flaggedsync-files-test.jsView file
358patternName = generic_password
severity = medium
line = 358
Medium
364patternName = generic_password
severity = medium
line = 364
Medium
bin/ploypress.jsView file
1#!/usr/bin/env node
L2: const { spawn, spawnSync } = require('child_process');
L3: const fs = require('fs');
High
Findings
3 Critical4 High7 Medium4 Low
CriticalPersistence Backdoorsrc/sshSetup.js
CriticalTrigger Reachable Dangerous Capabilitysrc/sshSetup.js
CriticalPrevious Version Dangerous Deltabackup-test.js
HighChild Processbin/ploypress.js
HighTrigger Reachable Persistencesrc/backupScheduler.js
HighRuntime Package Installscripts/electron-builder-wrapper.js
HighSemantic Analysis Limitedrenderer/app.js
MediumSecret Patternsync-files-test.js
MediumDynamic Requireerase-test.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/backupScheduler.js
Affected versions and remediation
This report applies to ploypress@2.4.1.
See all versions of ploypress for other recorded verdicts.
- Review the evidence and your use of ploypress@2.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.