UNC6426 Hackers Exploit NPM Package to Gain AWS Admin Access in 72 Hours - Cybernoz - Cybersecurity News

UNC6426 Hackers Exploit NPM Package to Gain AWS Admin Access in 72 Hours - Cybernoz - Cybersecurity News

UNC6426 hackers turned a routine NPM update into a direct path to full AWS administrator access in under 72 hours, highlighting how fragile CI/CD-to-cloud trust can become when roles are overly permissive.​ When a developer at the victim organization updated or installed the affected package via a code editor plugin, the postinstall script silently executed on their workstation. QUIETVAULT scanned the system for environment variables, configurat…

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim's cloud environment within a span of 72 hours. The attack started with the theft of a developer's GitHub token, which the threat actor then used to gain unauthorized access to the cloud and steal data. "The threat actor, UNC6426, then used this