Malicious code shipped in Amazon Q Developer VS Code extension 1.84.0, per AWS

Summary

AWS bulletin AWS-2025-015 (CVE-2025-8217): malicious code was distributed with version 1.84.0 but, per AWS, did not execute due to a syntax error. AWS removed 1.84.0 from distribution channels and released 1.85.0.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

• GOVERN 6.1 Policies address risks from third-party software and data
• MANAGE 3.1 Third-party risks are monitored and controls applied

NIST SP 800-53

• SR-3 Supply Chain Controls and Processes
• SR-11 Component Authenticity
• CM-14 Signed Components
• SA-10 Developer Configuration Management

Human-approval (JCR) checkpoint

yes: release sign-off; destructive commands

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• Cyber CYB-001 Malicious nx and Nx plugin versions published to npm collected credentials, per Nx

  same technique derived from CYB-001

  Both are supply-chain compromises in which malicious code shipped in a published developer package release: nx versions on npm, per Nx, and Amazon Q Developer extension 1.84.0, per AWS.

  Source: aws.amazon.com https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

• Cyber CYB-002 Compromised tj-actions/changed-files GitHub Action exposed CI secrets, per CISA

  same technique derived from CYB-002

  Both involve a compromised CI or build pipeline: CISA reports the tj-actions/changed-files GitHub Action was compromised, and AWS says an inappropriately scoped GitHub token in a CodeBuild configuration let the actor commit code that was automatically released.

  Source: aws.amazon.com https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

• Cyber CYB-004 Ultralytics releases on PyPI compromised through its GitHub Actions workflows and PyPI token, per PyPI

  same technique derived from CYB-004

  In both, build or publish pipeline credentials were used to ship a malicious package release: PyPI reports the Ultralytics workflows and then its PyPI API token were compromised, and AWS says an inappropriately scoped GitHub token let the actor commit code that was automatically released.

  Source: aws.amazon.com https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

Sources

• aws.amazon.com primary link checked 2026-10-31, HTTP 200
  Published 2025-07-23 6:00 PM PDT; updated 2025-07-25
  https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

Corrections

• 2026-10-28 Verification round 1: date month confirmed (published 2025-07-23 PDT). Replaced "unauthorized code" with AWS's wording "malicious code" and stated that it did not execute due to a syntax error.

To report an error in this entry, see corrections.