️ SECURITY WARNING: the copies of BIG OKUTI / Kipfel shared by zenpit contain a hidden spyware backdoor.
The pack has an injected file 'Editor/BlendShapeUtility_kip.cs' (class ABF_ControlPanelTrigger_Prod_Kip) that:
auto-runs via [InitializeOnLoad] the moment the Unity project opens;
silently reads your VRChat display name via reflection (VRC.Core.APIUser.CurrentUser.displayName);
posts it to an AES-encrypted Discord webhook ('きぷでか2', guild 1388867720816234686) using WebClient.UploadData;
writes a stop-flag to Library/UnityCache/config_kip and swallows all errors.
The original Booth pack (booth.pm/items/7211713) does NOT contain this file. zenpit did the same thing to 'Avatar Blink Fix' (BlendShapeUtility.cs / ABF_ControlPanelTrigger_abf11, webhook 'Captain Hook', same Discord guild) — admin already flagged that topic and it was deleted, and zenpit's posts here (#3, #4) were also deleted.
If you downloaded this from zenpit:
delete 'BlendShapeUtility_kip.cs' (and any 'BlendShapeUtility*.cs') from your project;
review the whole pack for other injected files;
your VRChat display name may have been sent to that server, so be careful.
Please flag zenpit's posts and don't trust his repacks. Stay safe!
