ct-fivem

FiveM CLI launcher and auto-reconnect watchdog

This report shows the evidence for ct-fivem@1.1.4. 2 of 6 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a concrete, automatically triggered persistence and unattended remote-update chain, not a normal user-invoked update command. Absence of an npm lifecycle hook does not mitigate the behavior reached by every CLI invocation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs any ct-fivem CLI command.

Impact

Unconsented recurring code replacement and telemetry reporting outside the invoking terminal.

Mechanism

silent scheduled-task/crontab persistence plus unattended global self-update

Attack narrative

The bin entry loads src/cli.js, which silently registers persistence before parsing any command. On Windows it creates a hidden scheduled task; on Linux/macOS it replaces the user's crontab with an entry that repeatedly installs the latest ct-fivem globally. Update checks and installs are package-controlled, while a default Discord webhook receives host and activity information.

AI rationale

Evidence

package.jsonbin/ct.jssrc/cli.jssrc/utils/autoupdate-service.jssrc/utils/update.jssrc/config/config.jssrc/utils/discord.js

Network endpoints2

registry.npmjs.orgcanary.discord.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/cli.js invokes background-service registration on every CLI run, including help/version.
src/utils/autoupdate-service.js creates a hidden Windows scheduled task or installs a crontab entry every 30 minutes.
The persisted commands silently run `npm install -g ct-fivem@latest`.
src/utils/update.js also auto-installs a newer global package after querying the npm registry.
src/config/config.js embeds a default Discord webhook; src/utils/discord.js sends host/platform and activity data to it.

Evidence against

package.json contains no npm lifecycle hook.
Persistence starts after explicit CLI execution, not package installation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 47.8 KB of source, external domains: canary.discord.com, cfx.re

Source & flagged code

7 flagged

src/utils/update.jsView file

Lines 1-44javascript

1const https = require("https");

2const { exec } = require("child_process");

3const pkg = require("../../package.json");

High

Child Process

Package source references child process execution.

src/utils/update.jsView on unpkg · L1

4const config = require("../config/config");

5const logger = require("./logger");

6const { sendDiscordWebhook } = require("./discord");

8function isNewerVersion(current, latest) {

9 if (!current || !latest) return false;

10 const c = current.replace(/^v/, "").split(".").map(Number);

11 const l = latest.replace(/^v/, "").split(".").map(Number);

13 for (let i = 0; i < Math.max(c.length, l.length); i++) {

14 const cv = c[i] || 0;

15 const lv = l[i] || 0;

16 if (lv > cv) return true;

17 if (lv < cv) return false;

18 }

19 return false;

20}

22function installUpdate(version) {

23 return new Promise((resolve, reject) => {

24 logger.info(`🚀 New version v${version} published! Auto-installing update...`);

25 exec("npm install -g ct-fivem@latest", (err) => {

26 if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/update.jsView on unpkg · L24

27 logger.warn(`Auto update failed: ${err.message}`);

28 return reject(err);

29 }

30 logger.info(`✓ Successfully updated ct-fivem to v${version}!`);

31 resolve(true);

32 });

33 });

34}

36function fetchLatestNpmVersion(timeoutMs = 3000) {

37 return new Promise((resolve) => {

38 const options = {

39 hostname: "registry.npmjs.org",

40 path: "/ct-fivem/latest",

41 method: "GET",

42 headers: {

43 "User-Agent": `ct-fivem/${pkg.version} (Node.js)`,

44 },

src/utils/autoupdate-service.jsView file

Lines 1-46javascript

1const { exec } = require("child_process");

2const path = require("path");

3const os =

src/fivem/launcher.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ct-fivem@1.1.0 matchedIdentity = npm:Y3QtZml2ZW0:1.1.0 similarity = 0.682 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/fivem/launcher.jsView on unpkg

Source & flagged code

7 flagged · loading source

src/utils/update.jsView file

1const https = require("https"); L2: const { exec } = require("child_process"); L3: const pkg = require("../../package.json");

High

Child Process

Package source references child process execution.

src/utils/update.jsView on unpkg · L1

24logger.info(`🚀 New version v${version} published! Auto-installing update...`); L25: exec("npm install -g ct-fivem@latest", (err) => { L26: if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/update.jsView on unpkg · L24

src/utils/autoupdate-service.jsView file

1const { exec } = require("child_process"); L2: const path = require("path"); ... L5: const { fetchLatestNpmVersion, isNewerVersion } = require("./update"); L6: const pkg = require("../../package.json"); L7: const logger = require("./logger"); ... L19: // Check if task already exists L20: exec(`schtasks /Query /TN "${TASK_NAME}"`, (err) => { L21: if (!err) { ... L38: // macOS / Linux cron fallback L39: exec("crontab -l", (err, stdout) => { L40: if (!err && stdout && stdout.includes("ct-fivem")) return;

Findings

3 Critical4 High3 Medium4 Low

CriticalPersistence Backdoorsrc/utils/autoupdate-service.js

CriticalTrigger Reachable Dangerous Capabilitysrc/utils/autoupdate-service.js

CriticalPrevious Version Dangerous Deltasrc/fivem/launcher.js

HighChild Processsrc/utils/update.js

HighShellsrc/utils/autoupdate-service.js

HighTrigger Reachable Persistencesrc/utils/autoupdate-service.js

HighRuntime Package Installsrc/utils/update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to ct-fivem@1.1.4.

The versions list below shows the verdict for each recorded version.

Avoid installing ct-fivem@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-09 18:01:40.138Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

1.1.4latestshownMaliciousPersistenceBlockPublishedAug 9, 2026, 10:28 AM 1.1.3MaliciousPersistenceBlockPublishedAug 9, 2026, 10:20 AM 1.1.0Clean—AllowPublishedAug 9, 2026, 2:57 AM 1.0.2Clean—AllowPublishedAug 9, 2026, 2:38 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Related packages

Other persistence packages

Source & flagged code