npm Supply-Chain Attacks Steal Developer Tokens and Enable Cloud Compromise

Threat actors are using malicious npm packages to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that UNC6426 leveraged keys stolen during the earlier compromise of the nx npm ecosystem to pivot from a stolen developer GitHub token into AWS administrative access within 72 hours, abusing GitHub-to-AWS OpenID Connect (OIDC) trust to create a new admin role. The actor then used that access to exfiltrate data from AWS S3 and conduct destructive actions in production cloud environments; the initial nx compromise involved a GitHub Actions pull_request_target workflow abuse (“Pwn Request”) that enabled publishing trojanized packages containing a postinstall chain that executed the QUIETVAULT JavaScript credential stealer and uploaded stolen data to a public GitHub repo (/s1ngularity-repository-1).

Separately, researchers reported new waves of the PhantomRaven npm supply-chain campaign distributing 88 additional malicious packages (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like .gitconfig and .npmrc, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses slopsquatting (LLM-suggested lookalike package names) and a stealth technique called Remote Dynamic Dependencies (RDD), where package.json pulls a dependency from an external URL so the malicious payload is fetched at install time (npm install) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.