Shady Malware

[RenegadeMaster]

Do not install this

[MxFish]

proof

[RenegadeMaster]

Literally just go through the code

[RenegadeMaster]

• Explicit data exfiltration endpoints used by design. The code sends telemetry, room data, user IDs, cosmetics, enabled mods, and errors to https://iidk.online and uses a persistent websocket to wss://iidk.online for friends/features. See Classes/Menu/ServerData.cs, Managers/FriendManager.cs,

• Menu/Main.cs, Managers/AIManager.cs. 
  

• Remote code/content loading that can execute or alter behavior. The plugin system can download and load DLLs from a server list (PluginInfo.ServerResourcePath) and uses reflection to execute OnEnable/Update/OnGUI on them. See Managers/PluginManager.cs. There is also Lua script loading from

• arbitrary URLs (LuaAPISite) and a “SafeLuaURL” feed. See Classes/Menu/Console.cs.
  

• Auto‑update scripts download and replace the DLL. Update scripts fetch the latest release over the network and then relaunch the game. See Mods/Settings.cs. If the release source is compromised, that’s an easy trojan path.
• Additional network features send user‑provided content. TTS and translation send text to https://iidk.online and https://lazypy.ro; AI prompts go to https://text.pollinations.ai. See Menu/Main.cs, Managers/AIManager.cs.
• Asset downloading from GitHub at runtime. The app downloads assets from raw GitHub URLs for Console and resources, which changes runtime content. See Classes/Menu/Console.cs, Utilities/AssetUtilities.cs.
• Local file writes and Process.Start usage. The app writes configs, macros, messages, and scripts inside the plugin data directory, and opens URLs/folders/scripts via Process.Start. No registry or persistence behavior was found. See Plugin.cs, Managers/PluginManager.cs, Mods/Settings.cs, Mods/

• Movement.cs, Mods/Sound.cs, Mods/Experimental.cs.
  

[MxFish]

that's quite incriminating to be fair.

[RenegadeMaster]

At the very least you are trusting the authors/contributors very, very, very much to do nothing bad but it's an open door

[MxFish]

Ok I haven't actually downloaded the latest release so I'll look into it further.

[MxFish]

yeah no it's fine it's just because it runs quite a fair few scripts which makes a computer flag it as malware, but really, I highly doubt we're going to have another USA menu incident. (that was bad).