OVHcloud CLI releases backdoored on GitHub to steal developer secrets

Attackers compromised a developer's GitHub account to inject information-stealing malware into OVHcloud's CLI tool releases versions 0.11.0 through 0.15.0. The malicious releases were published on October 19, 2026, and detected within two hours. The malware aimed to retrieve secrets from users' disks. The CI/CD pipelines were not compromised, as the attacker modified existing releases directly, facilitated by disabled GitHub release immutability settings. OVHcloud has since enabled release immutability and considers the incident resolved. The attack is attributed to the GlassWorm group, which has targeted multiple software development platforms since late 2025. Affected platforms include macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64. Source builds and Docker images remain clean.

The compromised CLI tool versions contained malware capable of stealing sensitive developer secrets stored on affected systems. This could lead to credential theft and unauthorized access to cloud and hosting services managed via the CLI. The attack vector was supply chain compromise via GitHub repository hijacking. Users running affected versions risked exposure of secrets and should assume full compromise of credentials. The incident was contained quickly, limiting broader impact. No CI/CD pipeline compromise occurred, reducing risk of further supply chain contamination.

OVHcloud has enabled GitHub's release immutability feature to prevent modification of published releases. Users who downloaded versions 0.11.0 through 0.15.0 should immediately remove or update the CLI tool to version 0.16.0 or later. Affected users must perform thorough system cleanup and revoke all secrets stored on the machine, as the malware was designed to steal these. Since the CI/CD pipelines were not compromised, no further action on build infrastructure is required. OVHcloud considers the incident resolved following these measures.