UNC6426 Hackers Hijack NPM Package for Rapid AWS Admin Compromise

{
“title”: “How a Single NPM Update Gave Hackers Full AWS Control in 72 Hours”,
“content”: “

The breach didn’t start with a phishing email or a brute-force attack on a server. It began with a routine software update. For a development team at an unnamed organization, installing a popular NPM package via their code editor’s plugin seemed like an ordinary Tuesday. Within three days, that single action had handed a sophisticated threat actor, tracked as UNC6426, the keys to the kingdom: full administrator access to their Amazon Web Services (AWS) environment. This incident is a stark case study in how modern software supply chain attacks can exploit the trusted, automated connections between development tools and cloud infrastructure, turning everyday developer workflows into catastrophic security failures.

The Silent Injection: Compromising the Development Pipeline

The attack’s elegance lies in its subtlety and abuse of trust. UNC6426 did not target the victim’s infrastructure directly. Instead, they compromised a legitimate NPM package—a library of code developers routinely include in their projects. The specific package was not named in the initial report, but the method is a recurring and effective tactic. The attackers injected malicious code into the package’s postinstall script. This script is designed to run automatically after the package is installed, a standard feature for packages that need to perform setup tasks like compiling native code or downloading dependencies.

The critical vulnerability was the victim’s development environment configuration. Developers were using a code editor plugin that automatically installs or updates NPM packages as they code. When a developer saved their work or the plugin synced, it fetched the latest version of the compromised package from the NPM registry. The malicious postinstall script executed silently in the background, with no warning or prompt to the developer. This script was the attacker’s first-stage payload, a small piece of code designed to do one thing: establish communication with the attacker’s command-and-control (C2) server and await further instructions. The entire initial compromise was invisible to the user and, initially, to any security tools monitoring only network traffic or endpoint activity, as it appeared as normal package manager activity.

From Development Tool to Cloud Admin: The Privilege Escalation Chain

Once the foothold was established in the developer’s environment, UNC6426 began the systematic escalation. The malicious script didn’t try to encrypt files or steal source code immediately. Its purpose was reconnaissance and credential harvesting. It scoured the local environment for any files containing cloud credentials, a common practice in development setups where credentials might be stored in configuration files for testing. More insidiously, it looked for the specific configuration files used by the AWS Command Line Interface (CLI) and Software Development Kits (SDKs), which are ubiquitous in modern development.

The jackpot came in the form of an AWS access key and secret key pair. These credentials were likely associated with an IAM (Identity and Access Management) role or user that had been granted overly permissive permissions for convenience. This is the second critical failure point in the attack chain. The principle of least privilege—granting only the minimum permissions necessary for a task—was not followed. The compromised credentials had broad, administrative rights across the AWS account. With these keys, the attackers could now use the AWS CLI or SDK, just as the legitimate developer would, to call any AWS API.

Armed with admin-level credentials, UNC6426 moved swiftly. They created their own IAM user accounts with administrative privileges to ensure persistent access, even if the original stolen keys were rotated or revoked. They may have also created backdoor access methods, such as EC2 instances with SSH keys they controlled or Lambda functions that could be triggered externally. The 72-hour timeline from initial NPM install to full AWS admin control reflects a highly automated and efficient operation, where each step of the attack chain—from initial script execution to credential discovery and cloud resource manipulation—was scripted and required minimal manual intervention from the attackers.

The Fragile Trust: Why CI/CD and Cloud Integrations Are Prime Targets

This attack underscores a fundamental shift in the threat landscape. The trust relationship between a company’s continuous integration/continuous deployment (CI/CD) pipeline and its cloud provider is now a high-value target for adversaries. CI/CD systems, developer workstations,