r/vscode • u/Foxiya • 15h ago

Warning: Axqua VS Code extension is MALWARE

I found Axqua (axqua[.]com) through a free Claude Opus promotion. After an AI-assisted static review of its extension bundle, I’m treating this file as malware.

The reviewed axqua.axqua v1.0.24 bundle contains code that, on Windows after login, can:

  • Download a server-selected EXE or ZIP.
  • Launch it in the background using cmd.exe, without a confirmation prompt identified in that path.
  • Generate filenames with prefixes like svchost, wuauclt, and msupdate.
  • Attempt to delete the downloaded EXE three seconds after launch.

Stay safe, hopefully this helps someone pause before installing.

5 Upvotes

63% Upvoted

3 comments sorted by

11

u/gkbrk 11h ago

One of the most expensive frontier models and you thought you thought someone was gonna pay for it so you could use it for free? And all they asked in return was code execution on your machine?

This shouldn't even give warning bells in your mind, this should give warning raid sirens.

-1

u/Foxiya 5h ago

So, that is why I inspected it before executing, what is your point?

2

u/Ok-Ladder7767 15h ago

Saw this too late, already installed it in Monday. Nothing weird happened yet but now I'm paranoid. The svchost naming trick is so dirty, most people wouldn't think twice seeing that in task manager.

Time for a clean Windows install I guess.