From a Stolen Token to Full AWS Admin Access in 72 Hours — The UNC6426 nx Supply Chain Attack Explained

The origin of this attack dates back to August 2025, when the nx npm package — a widely used build system and developer tooling framework with millions of weekly downloads — was compromised in an attack known as s1ngularity. During that four-hour window, attackers who had stolen an nx npm publishing token pushed malicious versions of several nx packages to the npm registry. These malicious versions contained a post-install script that silently scanned developer machines for credentials, secrets, SSH keys, and cloud API keys, exfiltrating everything to attacker-controlled repositories. Tens of thousands of files and over two thousand distinct secrets were exposed across the developer community. UNC6426 was sitting on one of those stolen credentials for months before acting. The attack on the victim organization began when an employee ran a code editor using the Nx Console plugin, which triggered an update and executed the malicious payload known as QUIETVAULT. That single action handed UNC6426 a developer's GitHub Personal Access Token.

With the stolen token in hand, UNC6426 moved fast and methodically. Two days after the initial compromise they used an open-source tool designed to extract secrets from CI/CD environments to enumerate the victim's GitHub environment and steal credentials for a GitHub service account. They then used that service account with a specific parameter to generate temporary AWS Security Token Service tokens for the organization's Actions-CloudFormation role. The critical weakness here was that the CloudFormation role was overly permissive. UNC6426 used its permissions to deploy a new AWS CloudFormation stack with one sole purpose — creating a new IAM role and attaching the AdministratorAccess policy directly to it. From a stolen developer token to full AWS administrator access in under 72 hours. From there the destruction was systematic: attackers enumerated and accessed all S3 buckets, terminated production EC2 and RDS instances, decrypted application keys, and in the final stage renamed every internal GitHub repository with the /s1ngularity-repository prefix and made them all public.