GCVE-110-OSM-2026-11262

The most alarming indicator is `out/src/__remote_core-bootstrap.js`, whose Chinese comment explicitly states it is 'delivered by PluginServer and executed after successful login' — a server-side remote code delivery and execution mechanism embedded in the extension. This is compounded by a decoded-base64 finding in `LuaFiledCompletionInfo.js` that surfaces a `Function(` constructor, indicating base64-encoded JavaScript being eval'd via the Function constructor — a classic obfuscation-plus-execution pattern. The `AuthClient.js` implements short-lived in-memory session keys ('仅内存保存，不落盘：短期会话密钥'), consistent with a license gating system that unlocks remotely delivered code. While the extension has plausible legitimate surface area (Lua debugger for Cocos/Unity/OpenResty, a real homepage, consistent Chinese developer identity), the combination of a remote bootstrap script explicitly designed to receive and execute server-dispatched code, a base64+Function-constructor execution chain, and a brand-new single-version package from an unknown publisher warrants deep manual review before trusting installation. This package runs a base64 encoded script in out/src/luatool/provider/completion/LuaFiledCompletionInfo.js. This script does not appear malicious at this time, but we are marking this as a low as there are more than one red flags related to this extension. OBFUSCATION - Decoded Base64 Content in out/src/luatool/provider/completion/LuaFiledCompletionInfo.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in ex/svn-scm-new/out/extension.js: "require("child_process")" PAYLOAD FILES out/src/luatool/provider/completion/LuaFiledCompletionInfo.js