Qbox Lua - CfxLua & FiveM

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Qbox Lua extension provides CfxLua language support for FiveM resource development, offering native completion, diagnostics, formatting, and navigation. As a language server, it inherently requires filesystem access to read workspace files for parsing and generating diagnostics, and write access to apply formatting changes. This level of access is entirely justified by the stated purpose of the extension and is standard behavior for any integrated development environment language tooling.

The security findings in the bundle are overwhelmingly false positives generated by the automated scanner and its known limitations with bundled JavaScript. The 215 indicators of compromise are almost entirely JavaScript property access chains misidentified as network domains. For example, strings like console.info, buf.is, events.as, glm.circle, glm.dot, and hash.is are standard object property lookups in the source code, not actual network endpoints. When we look at the actual domains extracted, they are legitimate resources for the FiveM and GTA V modding community. The endpoint cfx.re is the official domain for CitizenFX and CfxLua, while docs.ragepluginhook.net and gta5offset.com are well-known modding documentation and offset databases.

The single network finding, titled NET-JQUERY_AJAX-extension/dist/assistantMcp.js-1, flags a jQuery AJAX call within the bundled extension/dist/assistantMcp.js file. This is a standard pattern for extensions that include a webview or need to fetch remote configuration, and it does not indicate malicious data exfiltration. Furthermore, the 97 code-smell findings are the expected result of YARA rules firing on the minified and bundled code within the distribution directory. These rules match basic Node.js and web patterns, not intentional obfuscation or malware.

There are zero findings related to credential theft, malware signatures, or tool poisoning. The extension does not attempt to read environment files, SSH keys, or secret storage. It declares no special host permissions in its manifest, relying on the standard workspace access granted to all language extensions.

The strongest counterargument to this benign assessment is the relatively low user count of 218 and the presence of the assistant module, which might imply an artificial intelligence feature that could theoretically exfiltrate code. However, the implementation in the assistant file is a local or user-configured integration, and the only network activity flagged is a standard jQuery request. Without any evidence of unauthorized data transmission to unknown servers, the presence of an assistant module does not constitute a security risk. The high finding count is a classic case of multiplicative false positives from bundled dependencies, not a reflection of malicious intent.

Key Reasons

• IoC extractor misidentifies JavaScript property access chains like console.info and glm.dot as network domains
• Actual network endpoints include legitimate FiveM and GTA V modding resources such as cfx.re and gta5offset.com
• The single network finding is a standard jQuery AJAX call in a bundled dist file
• No malware signatures, credential access, or tool-poisoning findings are present
• Code-smell findings are expected noise from the bundled extension distribution directory

False Positive Considerations

• IoC extractor misreads JS property chains (console.info, glm.dot) as domains
• Code-smell YARA rules firing on bundled dist files
• High finding count driven by multiplicative false positives in bundled dependencies

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 95%.