Security · critical severity · found by reading the files

Obfuscated server Lua with infostealer indicators

Indicators, as patterns

return\(function\(a,\.\.\.
os\.getenv\(["'](appdata|localappdata)["']\)
leveldb
discordcanary|discordptb
Local Storage\\\\leveldb
PerformHttpRequest\s*\(\s*["']https://discord(app)?\.com/api/webhooks/

What it means

🚨 <resource> contains obfuscated server Lua that reads Discord/browser credential stores and posts to a hardcoded webhook. This is a token stealer. Do not run it.

How to fix it

Stop and remove the resource immediately. Treat the WHOLE package as compromised, not just the one file.
Rotate any credential that server could have touched.
If the feature is wanted, buy it from the real author and inspect server/main.lua again before deploying.

When it is not this

Unreadable does NOT mean malicious. Check the first 4 bytes: 'FXAP' (46 58 41 50) = CitizenFX official asset escrow = TRUSTED, same as any paid escrow asset. '1B 4C 75 61' or 'return(function(a,...' = FiveFuscator, a third-party obfuscator anyone can inject into = INSPECT HARD. Flagging every escrow-protected paid script as malware would destroy the product's credibility.