GCVE-110-OSM-2026-5550

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 9, 2026

Malicious package detected. Behaviors: code execution. Microsoft removal context: Extension ID: wenwj.luaforqc Publisher: wenwj Removal Date: 6/2/2026 Violation Type: impersonation Removed from the VS Code Marketplace by Microsoft for violating marketplace policies. Source: https://github.com/microsoft/vsmarketplace/blob/main/RemovedPackages.md ADDITIONAL FINDINGS - Shell Command Execution in out/common/luaPath.js: "require('child_process')" PAYLOAD FILES out/common/luaPath.js (+ out/extension.js, out/luaformat.js) INDICATORS (IOCs) - urls: http://www.lua.org/, http://www.lua.org/pil/, http://www.lua.org/manual/, http://www.lua.org/license.html, http://www.lua.org/home.html (+45 more) - domains: tencent.com, www.lua.org, Lua.org, foo.so, lua-users.org (+5 more) - emails: yvanfyin@tencent.com, handsomeli@tencent.com, richardzha@tencent.com, alexthkloss@web.de, 778235455@qq.com - payloadFileHash: d2f4d08194501dda8bef5c9b9c04e54ffc6c3cad609bf75f966b831502ba67ef

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	wenwj.luaforqc	0.2.44 (affected)	—

References

Malicious vscode package: wenwj.luaforqc

advisory

vendor

Browse GCVE Records

72,096 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON