Hijacked GitHub Account Used to Seed Five OVHcloud CLI Releases With Secret-Stealing Malware

An attacker used a compromised contributor’s GitHub account to replace download archives for OVHcloud CLI versions v0.11.0 through v0.15.0 with secret-stealing builds on October 19. The malicious files were available from 12:47 to 14:21 UTC, exposing users who downloaded and executed affected archives through installation or update paths without independently pinned hashes. A GitHub issue initially flagged replacements affecting v0.13.0–v0.15.0 after a reporter’s CI detected SHA-256 mismatches. OVHcloud said its source code, release tags, and build pipeline were unchanged; Homebrew installations, source builds, go install installations, and the existing Docker image were unaffected.

OVHcloud removed the malicious assets, enabled release immutability, and published clean version v0.16.0. Affected users were advised to rotate every secret potentially readable by the compromised binary from a different machine before replacing it. Security teams should review installation and update activity during the exposure window and verify downloaded artifacts against independently trusted hashes. Researchers identified a historical connection between the compromised contributor account and GlassWorm activity, but attribution of this attack remains unconfirmed and is not supported by analysis of the malicious binary.