The game allows the server to send an arbitrary string that gets executed as Lua code, and its environment has access to file read and write functions and the socket library that allows making HTTP connections. The relevant code is in web.c: case TE4_WEB_EVENT_RUN_LUA: if (!luaL_loadstring(he_L, ev...

Yes. The lead developer refuses to acknowledge it for obvious reasons, but I assure you it is true. This capability was only added after many years of development, so I think he originally really did intend to just make a game, and eventually decided that making it into malware could be a great way...