Amazon Q

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Amazon Q is AWS's own coding assistant for JetBrains IDEs, published by the AWS account with roughly 12.5 million users. Its stated job is indexing a project, answering questions about the code and proposing or applying edits. That job requires reading workspace files and running a language server process, and both of the files carrying real findings are that machinery.

The one network finding is NET-SOCKET_IO at plugin-amazonq/flare/indexing/lspServer.js:31. The path names the component: an indexing server inside a language server. Language servers open a local socket so the IDE front end can talk to the backend process. A socket in that file is transport between two local processes, not a channel to a remote host. The scan recorded no hardcoded remote address, no IoC entries, and the plugin listing declares no permissions and no network endpoints.

Both obfuscation findings land in plugin-amazonq/flare/aws-lsp-codewhisperer.js: OBFUSCATION-unicode_heavy flagged high and OBFUSCATION-function_indirect flagged medium. That path is a compiled, bundled language server binary artifact. Bundlers emit long identifier chains, escape non-ASCII string data and route calls through generated wrapper functions, and that output is what these two rules describe. A component that handles source code and prompts in many human languages will contain heavy Unicode by design. Neither rule says anything about intent.

The remaining alerts are 266 code-smell entries and 90 informational ones. These pattern rules match ordinary JavaScript: process and environment references, crypto calls, fetch calls, generic quality issues. They fire again for every npm library packaged inside the language server, which is why the total reaches 357. Nothing matched a malware signature, and the scan returned no secret or credential finding at all: no .env file, no .ssh key, no .git/config read, no cloud credential file, no JetBrains credential store access. For an extension that talks to AWS services, credential reads would be the pattern worth watching, and none are present.

The strongest counterargument is the finding volume. Hundreds of alerts on a plugin with this level of system access look alarming on a scorecard. The count does not survive inspection. Strip the code-smell rules and two observations remain, a socket in an LSP indexing server and bundler output in a compiled LSP file, both of which are what this class of extension is supposed to contain. The volume is a property of how many libraries got bundled, not of what the code does.

Key Reasons

• The only network finding, NET-SOCKET_IO at plugin-amazonq/flare/indexing/lspServer.js:31, is a local socket inside a language server indexing process, which is how LSP backends talk to the IDE.
• OBFUSCATION-unicode_heavy and OBFUSCATION-function_indirect both point at plugin-amazonq/flare/aws-lsp-codewhisperer.js, a compiled bundled LSP artifact, which is standard bundler output rather than deliberate hiding.
• No malware signature, no IoC, no dependency and no secret finding matched anywhere in the scan; the 266 low-severity alerts are code-smell rules that match ordinary JavaScript and every bundled npm library.
• The plugin is published by AWS with roughly 12.5 million users and declares no permissions and no network endpoints, which is inconsistent with an exfiltration or credential-theft operation.
• No credential-access indicator exists: no .env, .ssh, .git/config or cloud credential read, and no JetBrains credential store access appears in the results.

False Positive Considerations

• Code-smell YARA rules firing on ordinary JavaScript and on each bundled npm dependency inside the language server, producing 266 low-severity entries plus 90 informational ones.
• Obfuscation rules matching minified and bundled build output in plugin-amazonq/flare/aws-lsp-codewhisperer.js instead of intentional obfuscation.
• A local inter-process socket in an LSP server file being recorded as a network finding despite having no remote endpoint.
• Finding-count inflation: 357 total alerts driven by bundle size rather than by any single suspicious behavior.

Reviewed 2026-10-03; recommended action: suppress false positive; model confidence 90%.