Industry Newssupply chainci cdoidcgithub actions
UNC6426 Escalates NPM Supply Chain To AWS Administrator
|
7.2
UNC6426 operators leveraged a malicious postinstall (QUIETVAULT) injected into the Nx NPM framework to harvest developer GitHub personal access tokens and exfiltrate them to a public repo, within days achieving full AWS administrator privileges. Attackers used stolen PATs to compromise GitHub organizations, abused OIDC federation via NORDSTREAM to mint STS credentials, and created an AdministratorAccess IAM role.
Scoring Rationale
Rapid, practical threat showing CI/CD-to-cloud escalation in under 72 hours, limited by single-source reporting and moderate novelty.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
