Security News UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

[Divergent]

Content source

https://thehackernews.com/2026/03/unc6426-exploits-nx-npm-supply-chain.html

A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim's cloud environment within a span of 72 hours.

The attack started with the theft of a developer's GitHub token, which the threat actor then used to gain unauthorized access to the cloud and steal data.

"The threat actor, UNC6426, then used this access to abuse the GitHub-to-AWS OpenID Connect (OIDC) trust and create a new administrator role in the cloud environment," Google said in its Cloud Threat Horizons Report for H1 2026. "They abused this role to exfiltrate files from the client's Amazon Web Services (AWS) Simple Storage Service (S3) buckets and performed data destruction in their production cloud environments."

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

UNC6426 used stolen GitHub tokens from the 2025 nx npm breach to gain AWS admin access in under 72 hours, enabling data theft and cloud destruction.

thehackernews.com

 

[Divergent]

Executive Summary

Confirmed facts
Indicate that the threat actor UNC6426 utilized a trojanized nx npm package to deliver the QUIETVAULT JavaScript stealer to developer endpoints, subsequently pivoting from stolen GitHub Personal Access Tokens (PATs) to full AWS Administrator access within a 72-hour window.

Assessment
Success of this attack relies heavily on overly permissive CI/CD roles and the implicit trust placed in automated postinstall package execution, bypassing traditional network perimeter defenses.

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1195.002
Supply Chain Compromise: Software Dependencies (npm nx package).

T1059.007
Command and Scripting Interpreter: JavaScript/JScript (postinstall script execution).

T1552.004
Unsecured Credentials: Private Keys (GitHub PAT theft via QUIETVAULT).

T1098.003
Account Manipulation: Cloud Accounts (OIDC abuse to deploy AWS Stack).

CVE Profile

NVD Score
[High/Critical - Supply Chain / Workflow Injection]

CISA KEV Status
Active (Based on H1 2026 telemetry of the 2025 breach).

Telemetry

Malware
QUIETVAULT (JavaScript stealer).

Reconnaissance Tooling
Nord Stream (Used for CI/CD secret extraction).

Targeted Cloud IAM Policy arn:aws:iam::aws[:]policy/AdministratorAccess

Malicious AWS Stack Capabilities
["CAPABILITY_NAMED_IAM","CAPABILITY_IAM"]

Exfiltration/Defacement Artifacts
Renamed and publicized GitHub repositories matching the string /s1ngularity-repository-[randomcharacters] and /s1ngularity-repository-1.

Constraint
The exact structure of QUIETVAULT is unknown, but its execution suggests local file system enumeration targeting environment variables and developer credential stores, uniquely leveraging local LLM agents to parse for tokens.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

For environments utilizing Node.js, GitHub Actions, and AWS infrastructure.

GOVERN (GV) – Crisis Management & Oversight

Command
Audit all open-source dependencies and enforce software bill of materials (SBOM) policies.

DETECT (DE) – Monitoring & Analysis

Command
Query cloud SIEM/CloudTrail for the creation of new AWS Stacks utilizing CAPABILITY_NAMED_IAM combined with the attachment of AdministratorAccess policies by service roles.

Command
Hunt for GitHub repository renaming events matching the s1ngularity-repository string pattern.

RESPOND (RS) – Mitigation & Containment

Command
Revoke all GitHub Personal Access Tokens (PATs) exposed on affected developer machines.

Command
Isolate endpoints where the Nx Console plugin executed the malicious update.

Command
Delete unauthorized AWS IAM roles and revert any changes made by the Actions-CloudFormation role within the last 72 hours.

RECOVER (RC) – Restoration & Trust

Command
Restore deleted EC2 and RDS instances from isolated, immutable backups.

Command
Rotate all application keys that were stored in the compromised S3 buckets.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Apply the Principle of Least Privilege (PoLP) to all GitHub-to-AWS OpenID Connect (OIDC) roles. Remove standing admin privileges for automated CI/CD pipelines.

Command
Configure npm to ignore automated script execution globally by using the --ignore-scripts flag during package installation.

Remediation - THE HOME USER TRACK (Safety Focus)

The environmental reality check confirms this attack targets software developers. If you do not write code or manage cloud infrastructure, your risk is Theoretical/Low. If you are a developer, execute the following:

Priority 1: Safety

Command
Disconnect from the internet immediately if you suspect your local development environment executed the compromised nx package.

Command
Do not log into banking, email, or cloud management consoles (AWS/GitHub) from the affected machine.

Priority 2: Identity

Command
Reset your GitHub passwords and revoke all active Personal Access Tokens (PATs) using a known clean device (e.g., your mobile phone on a cellular network).

Priority 3: Persistence

Command
Purge the node_modules folder in any project utilizing the nx package and verify the integrity of your global npm cache.

Hardening & References

Baseline
CIS Benchmarks for Amazon Web Services (Focus: IAM Role permissions and OIDC federated trust boundaries).

Framework
NIST CSF 2.0 (PR.AA-01: Identities and credentials are managed; PR.DS-10: Principle of least privilege is implemented).

Reference
Secure configuration of package managers to prevent arbitrary code execution during postinstall phases.

Source

The Hacker News