BACKDOORS ALL OF HIS SCRIPTS HE POSTED HAVE BACK DOORS HERES A SCREENSHOT OF HIS TK DRUGS SCRIPT DONT DOWNLOAD!!!! ITS NOT WORTH YOUR SERVER

FiveM Resource Warning: Suspicious Backdoor Code Found

I recently inspected two FiveM resource ZIPs:

0r-heistpack.zip
0r_lib.zip

The exact copies I inspected contain concealed code that can download JavaScript from outside servers and execute it on the FiveM server/client environment.

I would not install or run these copies on a production server.

What was found?

🔴 0r-heistpack

The resource contains a file:

client/bootstrap.js

that extracts hidden Base64-encoded JavaScript from its own UI files and executes it using:

new Function(code)();

The decoded code reaches out to an external domain:

hzdh.4rf6.com

and can download additional JavaScript.

That downloaded content is then executed.

There are also files pretending to be fonts, such as:

Arial.ttf

that are not normal font files and contain obfuscated remote URLs.

The Lua code also contains an intentionally obscured reference to Lua's load() function:

_G[string.char(108,111,97,100)]

which resolves to:

_G["load"]

That is a common way of hiding dynamic code execution from a casual code review.

The archive also contains files/comments related to bypassing the resource's original licensing system, including names such as:

license-patch.js
index-patched.js
index-license-free.js

This strongly suggests the copy has been modified.

🔴 0r_lib

This one is even more concerning.

Obfuscated JavaScript decodes into code that connects to external servers including:

ebk.9ns1.com
mm.9ns1.com

It attempts to download remote JavaScript payloads from addresses similar to:

/zXeAHJJ
/zXeAHJJgg
/zXeAHJJcfxre

The response is then executed using JavaScript eval().

In simple terms, the behavior is:

Connect to outside server
        ↓
Download JavaScript
        ↓
Execute downloaded code

That means the person controlling the remote website can potentially change what gets executed without modifying the FiveM resource ZIP itself.

There is also another fake font file:

Roboto.ttf

containing an obfuscated external URL rather than normal font data.

Why this matters

A legitimate update checker normally does something like:

Check current version
↓
Compare version number
↓
Tell administrator an update exists

What these files do is fundamentally different:

Download executable code
↓
eval() / new Function()
↓
Run it

That creates a remote-code execution mechanism.

Depending on what the downloaded payload does, this could potentially be used to access things available to the server process, interfere with resources, steal configuration/secrets, or download additional code.

Indicators to search for

If you have used these resource copies, search your FiveM server files for strings like:

9ns1.com
4rf6.com
jgir
jgirJJ
zXeAHJJ
zXeAHJJgg
zXeAHJJcfxre
miausass

Also watch for patterns such as:

eval(data)
new Function(code)

and Lua obfuscation resembling:

_G[string.char(108,111,97,100)]

If you've already run them

I would recommend:

1. Stop the affected resources.
2. Remove the questionable copies of 0r-heistpack and 0r_lib.
3. Search the rest of your server for the domains and loader patterns above.
4. Inspect any other resources downloaded from the same source.
5. Rotate sensitive credentials the server process could access.
6. Check Discord webhooks, API tokens, database accounts, FiveM configuration, and other secrets.
7. Restore from a known-clean backup if you discover additional modifications.

Important clarification

I am not claiming that every official/original version of these resources is malicious.

This report applies specifically to the two ZIP files that were inspected.

They could have been modified, cracked, repacked, redistributed, or infected after leaving the original developer.

So the correct warning is:

The copies inspected contain concealed remote-code execution behavior. Verify the source and integrity of your own files before using them.

Bottom line

Both inspected packages contain behavior that should never be hidden inside an ordinary FiveM heist/library resource.

0r-heistpack.zip  🔴 UNSAFE COPY
0r_lib.zip        🔴 UNSAFE COPY

The biggest red flag is simple:

Remote JavaScript is downloaded and executed using eval() / new Function().

For a FiveM production server, that's enough reason to quarantine the files immediately. 🚨