Attackers backdoor five OVHcloud CLI releases on GitHub to steal secrets

On October 19, 2026, an attacker using the hijacked GitHub account of an OVHcloud contributor replaced the download archives on five already published releases of OVHcloud's official command line tool, v0.11.0 through v0.15.0, with a build designed to steal secrets stored on the disk of any machine that runs it. The swapped files were live from 12:47 to 14:21 UTC, about 94 minutes, covered macOS, Linux x86_64 and arm64, and Windows x86_64, and the checksums file was replaced so the published hashes matched. Exposure was limited to people who installed or updated through a path that checks no hash in that window: the official install script, a direct GitHub archive download, an unpinned CI fetch, or the CLI's own upgrade command. Homebrew, which pins hashes, go install and source builds, and the Docker image were not affected, and copies installed before 12:47 UTC and not updated are original. Version v0.10.0 is clean.

A downstream user's pinned SHA-256 check caught the swap. OVHcloud deleted the swapped archives at 14:21 UTC and shipped a clean v0.16.0 that evening as an immutable release, and said its source code, tags and build pipeline were not touched and that GitHub release immutability, which had not been enabled, has now been turned on. Founder Octave Klaba urged anyone affected to rotate every secret on the disk. OVHcloud has not said which files the binary reads, where it sends them, or how many copies were downloaded, and no swapped copy has been publicly analyzed. OpenSourceMalware ties the contributor account to the GlassWorm campaign through a March 2026 force push loader using a known GlassWorm Solana wallet, and notes that link is its inference.

Sources: BleepingComputer; The Hacker News