Rogue commit planted a file-wiping prompt in Amazon Q Developer

A malicious commit slipped into Amazon Q Developer for VS Code 1.84.0, using an overly scoped GitHub token to add a Q CLI call with a prompt to wipe the home directory and AWS resources. The code shipped on July 17, 2025, but failed due to a syntax error; the flaw is tracked as CVE-2025-8217.

• The Amazon Q Developer VS Code extension has nearly 1 million installs
• The rogue commit landed July 13, 2025; version 1.84.0 shipped July 17
• The prompt targeted the home directory and AWS resources via ec2, s3 and iam
• AWS said the code failed on a syntax error; the CVE is rated Medium