Hijacked Contributor Account Used to Replace OVHcloud CLI Release Assets

Oct 19, 2026 · Original article ↗

Summary

On Oct. 19, an attacker using a hijacked OVH contributor account replaced assets in five OVHcloud CLI releases with a secret-stealing build. OVH removed them and issued immutable v0.16.0; whether March GlassWorm-linked activity shared the same actor is unconfirmed.

Key points

The attacker used a legitimate contributor account and GitHub’s Releases API to replace assets in OVHcloud CLI versions v0.11.0–v0.15.0; investigators found no tag push or Actions workflow run during the replacement.
Replaced assets covered macOS, Linux x86_64 and arm64, and Windows x86_64, along with checksums. OVH removed them; the article reports they were available for up to 94 minutes.
A downstream CI job caught a changed SHA-256. Build metadata indicated a dirty build from a later source revision rather than the project’s normal release build; the deleted payload was not independently analyzed.
Investigators found an earlier loader in the contributor’s repositories. Its obfuscated code decoded to a second stage that used a Solana memo as a dead drop; the wallet appeared in public GlassWorm indicator lists.
The connection between the March account activity and October asset replacement is based on the shared account identity. Investigators say they cannot prove the same actor was responsible for both.
Users who ran affected downloads during the window are advised to treat accessible secrets as exposed, rotate them from another machine, remove the binary, and install v0.16.0 or later.
OVHcloud removed the replaced files and released immutable v0.16.0 with a release attestation. It said initial checks found no other affected repository and promised a post-mortem.

Article Details

Attack Vectors: A compromised contributor GitHub account was used through the Releases API to replace assets on five existing OVHcloud CLI releases; no tag push or GitHub Actions workflow ran.
A hidden preinstall.js loader in repositories associated with the compromised account decoded invisible variation-selector characters and used eval to run its payload. The first stage decrypted an AES-256-CBC blob.
The loader queried public Solana RPC endpoints for a wallet transaction memo containing a base64-encoded link to the next stage, which it fetched and evaluated.
The replaced CLI binary was described by Octave Klaba as looking for secrets stored on users’ disks. The article says OVHcloud has not published what paths the binary reads or where it sends data.
Defensive Notes: If the OVHcloud CLI was installed or updated from a replaced release between 12:47 and 14:21 UTC on 2026-10-19, treat secrets readable on that machine as exposed. Rotate them from a different machine and remove the binary.
Check retained binaries with go version -m, the CLI version output, and the archive SHA-256. The article identifies vcs.modified=true or the pseudo-version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty as signs of the malicious build.
Install v0.16.0 or later, pin hashes in CI, and verify the v0.16.0 release attestation.
Alert on force pushes to long-idle repositories, review preinstall scripts and files containing long runs of variation-selector characters, and block or review outbound Solana RPC requests from build hosts without a legitimate need.

Indicators of compromise

Type	Indicator	Context
SHA256	`0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c`	Hash of the decrypted second-stage payload from the loader.
SHA256	`3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb`	SHA-256 of the malicious v0.15.0 Linux arm64 CLI archive identified by the reporter’s pinned CI check.
SHA256	`43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70`	Hash of the malicious preinstall.js loader identified in the compromised contributor’s repositories.