AgentArmorHQ
Sign in
Installing carefully

Remove and replace any extension build you installed from version 1.84.0

AgentArmorHQ team1 min read

You will find any Amazon Q Developer extension build 1.84.0 you installed, remove it, and move to 1.85.0 or later. That build carried malicious code after a GitHub token was inappropriately scoped ([AWS bulletin](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/)).

  1. Check versionConfirm whether 1.84.0 is installed
  2. Uninstall 1.84.0Remove the build completely
  3. Install 1.85.0+Use the fixed release
  4. VerifyConfirm the installed version

Why it matters

The Amazon Q Developer extension for Visual Studio Code had an inappropriately scoped GitHub token in its CodeBuild configuration. A threat actor used it to commit malicious code to the open-source repository, and that code was automatically included in a release (AWS bulletin (opens external site)). The malicious code shipped in version 1.84.0 but failed to execute because of a syntax error (CVE-2025-8217 (opens external site)). The fix is to upgrade to 1.85.0 and remove every installation of 1.84.0 (CVE-2025-8217 (opens external site)).

Steps

  1. Determine whether you have 1.84.0 on each machine. Any install of that exact build is the one to remove.
  2. Uninstall the 1.84.0 build entirely. Removing it is what the fix requires, so do not stop at turning it off.
  3. Install version 1.85.0 or later. AWS released 1.85.0 as the fixed build and removed 1.84.0 from distribution channels (AWS bulletin (opens external site)).
  4. Confirm the installed version is 1.85.0 or newer before you consider the machine done.
  5. Repeat these steps on every machine where you installed the extension, since each one needs its own removal and upgrade.
  6. Keep extensions current. Install new releases from publishers you rely on and check the version after each update.

Common mistakes

  • Disabling the extension instead of uninstalling it. Remove the 1.84.0 build entirely.
  • Forgetting other machines. Check each computer where you used this extension.
  • Assuming the syntax error made the build harmless. Treat any 1.84.0 install as something to remove.
  • Skipping the version check after upgrading. Confirm the installed number is 1.85.0 or newer.

Checklist

0 of 5 done

Sources

  1. AWS Security Bulletin: AWS-2025-015: Security Update for Amazon Q Developer Extension for Visual Studio Code
  2. NVD: CVE-2025-8217
Was this guide useful?