GCVE-110-OSM-2026-10691

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published August 20, 2026

SaassyCode VSIX Extension This VSCode extension has a preinstall lifecycle hook that downloads a Windows PE executable named perfect.exe and renames it %TEMP%\4649nadeshiko.exe. This file is known malicious. Please see external references below. package.json → activationEvents.onStartupFinished → src/extension.js → src/package.js → node_modules/typescripts/lolnstall.js → http[:]//boss67[.]icu/perfect.exe → 195b65512fc5b5489149efbccd75efc0919680046c29b18af47b2922ae920679

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	StackStudios.swimlane	1.0.1, 1.0.2 (affected)	—

References

Malicious vscode package: StackStudios.swimlane

advisory

vendor

Browse GCVE Records

417 records in the GCVE database · Updated August 26, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON