CVE-2025-8217: malicious code shipped in Amazon Q Developer for VS Code 1.84.0

What happened

• According to AWS's bulletin AWS-2025-015 (July 23, 2025), the extension had an inappropriately scoped GitHub token in its CodeBuild configuration. With it, a threat actor committed malicious code to the open-source repository, and it was automatically included in a release. [1]

Impact

• The malicious code was distributed in version 1.84.0 but failed to execute because of a syntax error, which AWS says prevented changes to any services or customer environments. [1][2]

What was done

• AWS revoked and replaced the credentials, removed the malicious code, released 1.85.0 and removed 1.84.0 from distribution channels. [1]

How to protect yourself

• Upgrade to 1.85.0 and remove all installations of 1.84.0. [2]

Sources

1. AWS-2025-015: Security Update for Amazon Q Developer Extension for Visual Studio Code — AWS Security Bulletin
2. CVE-2025-8217 — NVD

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.