AWS reported that version 1.84.0 of the Amazon Q Developer extension for VS Code contained malicious code committed to its open-source repository. AWS said the code failed to run because of a syntax error. The fix was version 1.85.0, and users were told to remove 1.84.0.
What AWS said
The security bulletin, tracked as CVE-2025-8217, was published on 23 July 2025 and updated on 25 July 2025. Its main points:
- The affected version is 1.84.0.
- Malicious code was committed to the extension's open-source repository and automatically included in a release.
- The threat actor got in through a GitHub token with overly broad access in the CodeBuild configuration.
- AWS Security reviewed the code and found it failed to execute because of a syntax error, so it could not change any AWS services or customer environments.
- The code remains present in existing 1.84.0 installations.
- AWS removed 1.84.0 from distribution channels and revoked and replaced the credentials.
- Version 1.85.0 is the fixed release.
The bulletin also lists a SHA-256 hash for verifying a 1.84.0 file. If you need to check a specific install, use the value published in the bulletin itself.
What users were told to do
AWS asked customers to remove all 1.84.0 installations from use and update to 1.85.0, including any forked or derivative copies. In VS Code, that means opening the Extensions panel, finding Amazon Q Developer, and choosing Update.
If your team manages developer machines, check the installed version across them rather than waiting for people to update on their own.
Why it matters even though it failed
A syntax error saved users here. The route in did not depend on luck: a build credential with more access than it needed let someone put code into a release path. If the code had been correct, an extension runs inside the developer's editor, which commonly sits near source code, tokens and cloud profiles.
Notice also that the extension is an AI coding assistant. Tools in this category get trusted quickly, and they update automatically by default. That combination is attractive to attackers.
What teams can do
- Know what is installed. Keep an inventory of extensions and versions on developer machines.
- Control updates. Read VS Code extension auto-update delay and pinning for options.
- Use an allowlist. See the VS Code extensions allowed guide.
- Review your own pipelines. Publishers should read GitHub token permissions: set read only default.
Safeguard's asset discovery and SBOM and dependency scanning can help you see what is in use, and the free scan at gold.safeguard.sh/scan covers your dependencies.
Quick check
Was anyone's AWS environment changed?
AWS stated that the code could not change any AWS services or customer environments because it failed to execute.
Is updating enough?
AWS said the code is still present in existing 1.84.0 installations, so remove them and move to 1.85.0, including forks.
Sources
Last reviewed: 19 October 2026.
