Five OVHcloud CLI releases swapped with secret-stealing malware on GitHub

Attackers hijacked a contributor's GitHub account and replaced the download archives of five existing OVHcloud CLI releases with a build designed to steal secrets from developers' machines, BleepingComputer and The Hacker News reported. The French cloud provider's command-line tool, used to manage OVHcloud infrastructure, was served in tampered form for roughly an hour and a half on October 19 before a customer's pipeline flagged the change.

What happened

According to The Hacker News, the attacker swapped the archives attached to releases v0.11.0 through v0.15.0, originally published between April and September 2026, from 12:47 to 14:21 UTC. In each release, the macOS x86_64 and arm64, Linux x86_64 and arm64 and Windows x86_64 archives were replaced, along with checksums.txt, so the published hashes matched the malicious files. Linux i386, Windows i386 and arm64 and WebAssembly builds were not touched.

The swap was caught by a customer whose CI job pinned the SHA-256 hash of the Linux arm64 archive. When the job began failing, the customer opened a public GitHub issue, and OVHcloud deleted the swapped files shortly afterwards, the report said.

OVHcloud founder and CEO Octave Klaba said the root cause was that GitHub's release immutability setting was disabled, allowing an account with sufficient permissions to modify existing releases without passing CI/CD checks, according to BleepingComputer. He said the pipelines, including tests and CVE scanning, were not affected, and that immutability has now been enabled. A clean v0.16.0 was published as an immutable release with a signed attestation, and the company has promised a detailed postmortem.

Technical details

The Hacker News reports that the malicious binary was a plain go build of a later, untagged commit uploaded directly to the releases rather than produced by the build pipeline. Its build metadata records commit 5ead8ef and the pseudo-version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, plus an -ldflags="-s -w" line absent from genuine releases. The swapped v0.15.0 Linux arm64 archive has the SHA-256 hash 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb.

OVHcloud has not said which files the binary reads, where it sends data or how many copies were downloaded, and no swapped archive has been analyzed publicly. The CLI stores OVHcloud API credentials in ~/.ovh.conf, but the advice covers every secret on an affected disk.

Community threat-intelligence platform OpenSourceMalware linked the compromised account to the GlassWorm campaign, which has previously targeted VS Code, OpenVSX, GitHub and npm. BleepingComputer notes the account's repositories contained a hidden preinstall.js loader that retrieves a second stage from a Solana memo, but The Hacker News stresses that the link to GlassWorm is an inference, as nothing from the October binary itself has been tied to the campaign.

Who is affected

Only users who downloaded affected archives on October 19 between 12:47 and 14:21 UTC were exposed. Homebrew users were protected by pinned hashes, and go install, source builds and the Docker image were not affected, according to The Hacker News.

What to do

• Check whether you installed or updated OVHcloud CLI during the window, including in CI pipelines that download archives without pinned hashes.
• If you cannot rule it out, rotate all credentials, API keys and tokens stored on the machine, doing so from a different system.
• Remove affected binaries, install v0.16.0 and verify it with gh release verify-asset.
• Review pinned-hash failures in pipelines around October 19.