wp-bootstrap

This Bash wrapper itself contains no obvious malicious logic (no hardcoded credentials, no network exfiltration, no shell backdoors). However, it materially increases supply-chain and code-execution risk by (1) executing a remote, unpinned package at runtime via pnpm dlx @wp-playground/cli@latest and (2) automatically running repository-defined build scripts when present. It also mounts local plugin/theme code into a WordPress runtime and, in Application Password API mode, mounts a local directory where sensitive auth artifacts may be written—delegated to the downstream CLI. If the repository contents or the remote CLI are not trusted, this wrapper could enable unintended or malicious code execution in the development environment.

No direct malware behavior (no network exfiltration, backdoor code, persistence, or credential theft) is visible in this script. The dominant security concern is supply-chain execution risk: it reads buildCommand from wp-bootstrap.config.json and executes it via eval, enabling arbitrary shell command execution if that configuration (or upstream inputs that produce buildCommand) is compromised. Additionally, it executes detect-structure.mjs to decide what gets packaged, and it uses detected/CLI-influenced paths without strict allowlisting before zipping. Overall, treat this as a high-impact packaging/build runner that must run only on trusted repositories and protected configuration.