UNC6426: Exploited nx npm supply chain for AWS admin access

A cybercriminal known as UNC6426 leveraged keys stolen after an attack on the Nx package supply chain on npm last year, managing to completely compromise an organization's cloud environment in just 72 hours.

See also: New malicious packages revealed in NuGet Supply Chain Attack

The attack began with the theft of a developer’s token from GitHub. The attacker used it to gain unauthorized access to the cloud and steal data. The supply chain attack targeting the Nx package on npm occurred in August 2025, when unknown attackers exploited a vulnerable pull_request_target — an attack technique known as Pwn Request — to gain elevated privileges and access to sensitive data, such as the GITHUB_TOKEN , and ultimately publish modified (trojanized) versions of the package to the npm registry.

The packages contained a postinstallthat activated a JavaScript credential stealer called QUIETVAULT. The malware collected environment variables, system information, and valuable tokens — including GitHub Personal Access Tokens (PATs) — by leveraging a Large Language Model (LLM) already installed on the system to perform the search. The stolen data was uploaded to a public repository on GitHub named “/s1ngularity-repository-1”.

According to Google, an employee of the target organization executed a code editor that used the Nx Console plugin. During the process the plugin was automatically updated, which triggered the execution of QUIETVAULT.

The UNC6426 threat group reportedly began reconnaissance activities on the target organization’s GitHub environment two days after the initial breach, leveraging the stolen PAT. To do so, it used a legitimate open source tool called Nord Stream, which allowed for the extraction of secrets from CI/CD, leading to the leakage of credentials for a GitHub service account.

See also: Open VSX: Supply Chain attack distributes GlassWorm via compromised dev account

The attackers then exploited this service account and used the “–aws-role” to generate temporary AWS Security Token Service (STS) for the “Actions-CloudFormation”, thereby gaining initial access to the victim organization’s Amazon Web Services environment.

Having now administrator privileges, the actors performed various actions, such as:

• recording and accessing objects within S3 buckets,
• termination of production instances of Amazon Elastic Compute Cloud and Amazon Relational Database Service,
• and decryption of application keys.

In the final stage of the attack, all of the organization's internal repositories on GitHub were renamed to “/s1ngularity-repository-[randomcharacters]” and made public.

To mitigate similar threats, it is recommended:

• the use of package managers that block postinstall scripts or sandboxing tools,
• the application of the principle of Least Privilege (PoLP) to CI/CD service accounts and roles associated with OIDC,
• the use of PATs with limited rights and short validity,
• the removal of permanent high privileges for high‑risk actions (such as creating admin roles),
• monitoring suspicious IAM,
• and adopting robust controls to identify risks associated with Shadow AI.

See also: Supply Chain Threat Protection: New security solution from SpyCloud

This incident is a prime example of what Socket describes as AI-assisted supply chain abuse, where the execution of the attack is delegated to AI agents that already have privileged access to the developer's file system, credentials, and certified development tools.