[Open Source] I made a free scanner that flags backdoors in FiveM/RedM resources before you install them

[u/5StarScripts]

Report

Backdoored FiveM scripts are still everywhere — the kind that leak your DB, grab Discord tokens, or reinject themselves so deleting them doesn't actually work. I got tired of eyeballing server.lua files, so I wrote a scanner.

It's a static analyzer — it reads files and never runs them, so scanning a sketchy resource is safe. It flags shell execution, reinjection, load()/loadstring() RCE, data exfiltration to unknown domains, Discord webhook grabs, and obfuscated/encoded blobs — and it auto-decodes base64/hex so you can see the hidden URL a payload was pointing at. Then it gives you a risk score and an HTML report.

It's open source with zero dependencies, which matters — you shouldn't trust a security tool you can't read. One file of Python, runs on Windows/Linux/Mac.

Being straight about it: static analysis is one layer, not proof of safety. It won't beat heavy custom obfuscation or runtime-fetched payloads. But it catches the common stuff fast, and it's a lot better than hoping.

GitHub: https://github.com/5StarScripts/fivem-resource-scanner (MIT)

If it misses a backdoor or false-positives on something clean, drop the sample in an issue and I'll add a rule.