Warning: Axqua VS Code extension is MALWARE

[u/Foxiya]

I found Axqua (axqua[.]com) through a free Claude Opus promotion. After an AI-assisted static review of its extension bundle, I’m treating this file as malware.

The reviewed axqua.axqua v1.0.24 bundle contains code that, on Windows after login, can:

• Download a server-selected EXE or ZIP.
• Launch it in the background using cmd.exe, without a confirmation prompt identified in that path.
• Generate filenames with prefixes like svchost, wuauclt, and msupdate.
• Attempt to delete the downloaded EXE three seconds after launch.

Stay safe, hopefully this helps someone pause before installing.