2026-03-11 · 2026-Q1
UNC6426 nx npm to AWS Admin Takeover
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
nx monorepo tooling / enterprise AWS
Impact
Attacker cloned GitHub repos, extracted CI/CD secrets, achieved full AWS admin; S3 buckets accessed, EC2/RDS terminated
Root cause
Compromised nx npm package delivered QUIETVAULT credential stealer; GitHub-to-AWS OIDC trust chain abuse
Sources
Catalog
Cite this: AgentProv incident record: UNC6426 nx npm to AWS Admin Takeover (2026-03-11). https://agentprov.com/incidents/2026-03-11-unc6426-nx-npm-to-aws-admin-takeover