GCVE-110-OSM-2026-358

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 9, 2026

Malicious package detected. Behaviors: code execution. Microsoft removal context: Extension ID: wenwj.luaforqc Publisher: wenwj Removal Date: 6/2/2026 Violation Type: impersonation Removed from the VS Code Marketplace by Microsoft for violating marketplace policies. Source: https://github.com/microsoft/vsmarketplace/blob/main/RemovedPackages.md ADDITIONAL FINDINGS - Shell Command Execution in out/common/luaPath.js: "require('child_process')" PAYLOAD FILES out/common/luaPath.js (+ out/extension.js, out/luaformat.js) INDICATORS (IOCs) - urls: http://www.lua.org/, http://www.lua.org/pil/, http://www.lua.org/manual/, http://www.lua.org/license.html, http://www.lua.org/home.html (+45 more) - domains: tencent.com, www.lua.org, Lua.org, foo.so, lua-users.org (+5 more) - emails: yvanfyin@tencent.com, handsomeli@tencent.com, richardzha@tencent.com, alexthkloss@web.de, 778235455@qq.com - payloadFileHash: d2f4d08194501dda8bef5c9b9c04e54ffc6c3cad609bf75f966b831502ba67ef

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	densy-little-studio.wonder-for-vscode-icons	all (affected)	—
unknown	devmidu-studio.svg-better-extension	all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected)	—
unknown	dark-code-studio.flutter-extension	* (affected), all (affected), * (affected), all (affected), all (affected), all (affected)	—
unknown	wenwj.luaforqc	0.2.44 (affected)	—
unknown	Portable.Xaml.Net	* (affected)	—