Installing FiveM scripts safely (and spotting malware)
Adding a new script to your FiveM server takes five minutes. Installing the wrong script also takes five minutes — but then you're busy for days instead, because the FiveM world is full of resources with a built-in backdoor. If you understand how a resource is put together and know where the red flags are, you install both faster and safer.
How a FiveM resource is structured
Everything your server runs lives in the resources folder. Each resource has its own folder there, and folders in square brackets like [standalone] are just categories to keep things organized — FiveM looks straight through them.
The heart of every resource is fxmanifest.lua (with older scripts you may still find __resource.lua). It defines which files run client-side, which run server-side, and which other resources the script depends on. Client files run on every player's PC, server files only on yours, and shared files in both places. That manifest is also your first checkpoint: a simple decoration script whose manifest also runs all sorts of things server-side raises questions. And if the manifest lists files you can't find in the folder — or the other way around, files that aren't mentioned anywhere — that's a reason to take an extra close look at what's going on there.
The folder name is also the resource name. Avoid spaces and odd characters, and don't rename a folder casually: some scripts reference their own name internally and then break without a clear error message.
Installing in four steps
- Inspect before you upload. Unpack the zip file locally and go through the code (what to look for is covered below). Uploading first and looking later is the wrong order.
- Upload to
resources. Via your panel or SFTP, neatly into a category folder, so six months from now you still know what lives where. - Add the resource to
server.cfgwith a line likeensure my-script. Order matters: your framework (such as ESX or QBCore) and libraries like oxmysql must be started before the scripts that rely on them. - Restart and test. Check the console to see the resource comes up without errors and test the functionality yourself in-game, preferably with a second account joining in.
One more tip that prevents a lot of hassle: never install five scripts at once. If something then goes wrong, you don't know which of the five is the culprit. Installing and testing one by one costs barely any extra time and saves you a hunt.
And be careful with your server.cfg itself. It contains your license key and often passwords and API keys too. Never just share that file in a Discord channel when looking for help with an installation problem — strip all the secrets out first. A leaked license key means someone else can impersonate your server, and you don't want that thrown in for free.
Paid, free or 'leaked'?
Paid scripts are almost always bought via Tebex, the official sales platform in the FiveM ecosystem. Many creators use escrow: the code is encrypted and only runs with your license. The upside is that you know for sure you have the original version. The downside: you can't read the encrypted code, so you can't inspect or modify it yourself, apart from the config files deliberately left open. That's a real trade-off, not a detail.
Free scripts from GitHub, on the other hand, are fully readable. Well-known projects have thousands of users watching, so mistakes and funny business come to light quickly. Small, unknown repos without history deserve the same suspicion as any random download from the internet.
Then there are the 'leaks': paid scripts offered for free somewhere. Apart from the fact that you're hurting the developers, leak sites are the distribution channel for malware. A leaked script has regularly been modified before being re-uploaded — with a little extra inside that costs you nothing, except your entire server.
Red flags: how to spot a backdoor
Just open every new resource in a text editor; Lua is quite readable, even without programming experience. These are the signals to look for:
| Signal | Why it's suspicious |
|---|---|
| Unreadable blocks of code: hex strings, base64, one gigantic line | Obfuscation hides what the code does — in a 'free' script it's almost always bad news |
load( or assert(load( on strings or downloaded data | Executes code that only arrives at runtime, completely out of your sight |
PerformHttpRequest to unknown domains at startup | Can fetch external commands or leak your server data |
| Discord webhooks you didn't set up yourself | Sends data from your server to someone else's channel |
| Event handlers that hand out money, weapons or permissions | The classic remote backdoor: the creator can make themselves admin remotely |
A practical search before every installation: search all files for PerformHttpRequest, load( and webhook. Not every hit is bad — a logging script is supposed to contain webhooks — but every hit must be explainable by what the script is meant to do.
One more nuance: encrypted escrow files from Tebex are something different from self-obfuscated Lua in a free download. In the first case the platform handles the encryption and you know the seller; in the second case the uploader has something to hide.
Stay alert after the installation too. A backdoor that keeps quiet in the code often still gives itself away through behavior: a resource that eats a striking amount of processing power according to resmon while doing nothing visible, or connections to domains you don't recognize. Keeping an eye on things for a few days after each new installation costs little and catches exactly the cases you missed while reading.
Got hit anyway? Here's how to clean up
Signs something is wrong: 'admins' you don't know, money or items out of nowhere, commands you never added, or a script connecting to strange domains. In that case:
- Take the server offline, so the backdoor can't be actively abused while you clean up.
- Replace all your secrets: license key, txAdmin and RCON passwords, database passwords and any API keys.
- Remove the suspicious resource — plus everything you got from the same source.
- Restore a backup from before the infection, or rebuild your resources folder from known, clean sources.
That last step feels drastic, but a backdoor may have modified other files. Only deleting the visibly bad script is a false sense of security. So make a backup before every new installation as standard practice — it turns recovery into a matter of minutes instead of days.
Experiment safely without risking your main server
The safest way to try new scripts is a separate test server without real player data. At MC-Node that costs nothing: the Free plan at €0.00 per month is meant for exactly that. Once a script has run cleanly there for a while, you can put it on your main server with peace of mind. For production you choose from plans ranging from Small (€1.75 per month) to Enterprise (€56.00 per month), all cancellable monthly, on our own hardware with NVMe storage and DDoS protection in the Previder data center in Hengelo. Check out the options in the MC-Node FiveM store — and keep that free test server alongside, because it is and remains your best defense against bad scripts.