Malicious code ships inside an agent extension release
Amazon Q Developer for VS Code 1.84.0 shipped malicious code an attacker committed with an over-scoped CI token. A syntax error kept it from running.
- Agents
- Amazon Q Developer
- Source checked
- Tags
- extensions, ci-tokens, release
Symptom
An official agent extension update contains code nobody on the team reviewed, released through the normal pipeline.
Cause
An inappropriately scoped GitHub token in the extension's CodeBuild configuration let an attacker commit malicious code to the open-source repo, and it was automatically included in a release.
Fix
Scope CI tokens to the minimum, require review for release-bound commits, and pin extension versions. AWS's remedy: remove 1.84.0 and update to 1.85.0.
# Check for and remove the affected version
code --list-extensions --show-versions | grep -i amazon-q
code --uninstall-extension amazonwebservices.amazon-q-vscode
# then install 1.85.0 or later