● Covered by 3 sources · 3 reportsMedium impact3 negative
OVHcloud CLI Releases Hijacked to Distribute Secret-Stealing Malware
Key points
- Attacker replaced OVHcloud CLI download archives on GitHub.
- Malicious files distributed secret-stealing malware.
- Affected five releases (v0.11.0-v0.15.0) for up to 94 minutes.
- OVHcloud issued a clean, immutable v0.16.0 release.
- Attackers hijacked a developer's GitHub account.
- The incident is part of a suspected GlassWorm operation.
- OVHcloud CEO Octave Klaba disclosed the compromise.
- Compromised release appeared at 14:47 on October 19.
- Compromise was detected and blocked at 16:21 after a customer report.
- Older version 0.10.0 was clean.
- GitHub's release immutability setting was disabled.
- Compromised binary's quality was poor.
- A user flagged the tampering publicly on GitHub.
- CI/CD pipelines were not impacted.
Malicious Files Injected into OVHcloud CLI Releases
On Monday, October 19, an attacker gained control of a contributor's GitHub account and used it to replace the download archives for five existing releases of OVHcloud's command-line tool. The injected files contained a build designed to steal secrets from the disk of any machine that executed it.
Exposure Window and Affected Users
The compromised files were available on GitHub for approximately 94 minutes, from 12:47 to 14:21 UTC. Users who installed or updated the OVHcloud CLI during this specific window, particularly on macOS, Linux x86_64 or arm64, or Windows x86_64, were at risk. The attack exploited a download path that did not perform hash checks.
OVHcloud identified releases v0.11.0 through v0.15.0 as compromised. Users who installed via the official install script, downloaded archives directly from GitHub release pages, ran CI jobs without pinned hashes, or used the CLI's upgrade command on affected platforms were exposed. Installations via Homebrew were not affected due to pinned SHA-256 hashes.
OVHcloud Response and Remediation
Following the discovery, OVHcloud removed the swapped archives and released a clean version 0.16.0 later that evening. This new release is immutable, preventing further unauthorized modifications. The company confirmed that the source code, release tags, and internal build pipeline were not compromised; the malicious build was a direct upload of a later commit to existing release pages.
Updates
- Compromised binary's quality was poor.
- A user flagged the tampering publicly on GitHub.
- CI/CD pipelines were not impacted.
- Attackers hijacked a developer's GitHub account.
- The incident is part of a suspected GlassWorm operation.
- OVHcloud CEO Octave Klaba disclosed the compromise.
- Compromised release appeared at 14:47 on October 19.
- Compromise was detected and blocked at 16:21 after a customer report.
- Older version 0.10.0 was clean.
- GitHub's release immutability setting was disabled.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A hijacked OVHcloud developer GitHub account was used to inject a secret-stealing binary into versions v0.11.0 through v0.15.0 of the OVHcloud command-line interface (CLI) tool. The incident, which occurred on October 19, affected users who installed or updated the CLI during a 94-minute window, highlighting supply chain vulnerability through developer account compromise.
Attackers compromised OVHcloud's open-source CLI tool, versions 0.11.0 through 0.15.0, by hijacking a developer's GitHub account to inject information-stealing malware. The incident, part of a suspected GlassWorm operation, allowed malicious versions to be distributed, prompting OVHcloud to warn users to update or remove the tool and revoke secrets.
An attacker compromised a contributor's GitHub account to replace download archives for five OVHcloud CLI releases with secret-stealing malware. The malicious files were live for up to 94 minutes, affecting users who installed or updated the CLI on specific platforms during that period. OVHcloud has since removed the compromised archives and issued a clean, immutable release.