BACKDOOR

 

Yes. This batch has a backdoor. Do not run this resource as uploaded.

The main problem is framework.js. It reads your fxmanifest, loads the configured UI file, extracts a Base64 string from const config, decodes the string, then executes the result with new Function(code)().

Your interface.html contains the Base64 payload inside const config.

Decoded, the payload is essentially JavaScript which contacts kim-aki.com, downloads more JavaScript, and executes the downloaded response with eval(). So whoever controls the remote server gets remote code execution inside the FiveM server process.

The fxmanifest loads framework.js as a shared script, which activates this loader when the resource starts.

There is a second malicious loader in en.lua. This line disguises load using string.char(108, 111, 97, 100), which spells "load". It then reads code hidden inside Roboto.ttf and executes the extracted content.

So you have at least two separate hidden execution methods:

1. framework.js → interface.html → Base64 payload → kim-aki.com → downloaded code → execution.

2. en.lua → Roboto.ttf → hidden Lua → load() → execution.

There is another security issue. functions(3).lua contains a Discord bot token directly in the source. Treat that token as compromised and regenerate it through Discord immediately.

version_checker(1).lua also contacts api.vezironi.com. From the code shown, this request appears to retrieve version information and does not execute the response.

Do not only delete framework.js. The en.lua and Roboto.ttf loader would still remain.

I would remove framework.js from the resource, remove it from shared_scripts in fxmanifest.lua, delete the malicious config block from interface.html, remove lines 126 to 127 from en.lua, replace Roboto.ttf with a clean copy, and rotate the exposed Discord bot token.

If this resource has already run on your server, assume the remote payload had the same permissions as your FXServer process.