Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

A supply chain attack targeted OVHcloud's CLI tool by compromising a developer's GitHub account. The attacker uploaded a secret-stealing binary to official releases v0.11.0 through v0.15.0, replacing legitimate binaries on GitHub. The malicious binary aimed to retrieve secrets from the disk. The incident was active for about 94 minutes on October 19, 2026, before being blocked following a customer report. The developer's account had been compromised since at least March 2026, with prior repository tampering involving a GlassWorm-linked loader. The attack exploited the lack of GitHub release immutability, allowing direct modification of published releases. Only users installing or updating via official scripts or GitHub downloads on macOS, 64-bit Linux, or Windows x86_64 during the incident window were affected. CI/CD pipelines and other installation methods were not impacted.

The compromised CLI versions contained a malicious binary capable of stealing secrets from users' disks, potentially exposing sensitive credentials or data. The attack was limited to a short time window (approximately 94 minutes), reducing exposure. The supply chain compromise affects users who installed or updated the CLI tool on common platforms via official channels during this window. Builds from source, Go installs, or Docker images were not affected. The incident highlights risks in software supply chains and the importance of release immutability controls. No evidence of exploitation beyond secret theft was reported. The attacker’s identity and full payload details remain unconfirmed.

OVHcloud blocked the compromised releases and enabled GitHub's release immutability option to prevent direct modification of published releases. Users should verify they are using version 0.16.0 or later of the CLI tool, which is confirmed clean. Users who installed or updated the CLI between versions v0.11.0 and v0.15.0 during the incident window should consider their secrets potentially compromised and rotate credentials accordingly. Users who built from source, used Go install commands, or pulled official Docker images are not affected and require no action. OVHcloud’s CI/CD pipelines were not impacted, and no further action is required on that front.