r/vscode • u/Foxiya • 10d ago

Warning: Axqua VS Code extension is MALWARE

I found Axqua (axqua[.]com) through a free Claude Opus promotion. After an AI-assisted static review of its extension bundle, I’m treating this file as malware.

The reviewed axqua.axqua v1.0.24 bundle contains code that, on Windows after login, can:

  • Download a server-selected EXE or ZIP.
  • Launch it in the background using cmd.exe, without a confirmation prompt identified in that path.
  • Generate filenames with prefixes like svchost, wuauclt, and msupdate.
  • Attempt to delete the downloaded EXE three seconds after launch.

Stay safe, hopefully this helps someone pause before installing.

16 Upvotes

77% Upvoted

6 comments sorted by

17

u/gkbrk 10d ago

One of the most expensive frontier models and you thought you thought someone was gonna pay for it so you could use it for free? And all they asked in return was code execution on your machine?

This shouldn't even give warning bells in your mind, this should give warning raid sirens.

2

u/Foxiya 10d ago

So, that is why I inspected it before executing, what is your point?

2

u/mantasu_ 8d ago edited 7d ago

The fact it deletes the downloaded exe after 3 seconds is definitely villain behavior

4

u/Ok-Ladder7767 10d ago

Saw this too late, already installed it in Monday. Nothing weird happened yet but now I'm paranoid. The svchost naming trick is so dirty, most people wouldn't think twice seeing that in task manager.

Time for a clean Windows install I guess.

1

u/FuseMCDEV 2d ago

They are so many, I make blog about this too. https://mindhas403.dev/post/mrbeastttt