cyber.hendryadrian.com
Cyber Attack & Data Breach · thehackernews.com

Hijacked GitHub Account Used to Replace Five OVHcloud CLI Releases With Secret-Stealing Malware

· Original article ↗

Summary

OVHcloud says an attacker replaced files in five CLI releases with a secret-stealing build, available for up to 94 minutes. The company removed the files, issued a clean release, and advised affected users to change stored secrets.

Key points

  • An attacker used a hijacked contributor account to replace download archives for OVHcloud CLI versions v0.11.0 through v0.15.0.
  • The altered files were available for up to 94 minutes on October 19 and affected selected macOS, Linux, and Windows builds downloaded during that window.
  • OVHcloud says the build was designed to steal secrets stored on a machine, but has not disclosed what files it reads or where data is sent.
  • The source code, release tags, and build pipeline were not changed; the malicious build was uploaded directly to existing GitHub releases.
  • OVHcloud removed the altered files, published a clean v0.16.0 release, and enabled release immutability. It advised affected users to change all secrets stored on disk.
  • OpenSourceMalware linked the contributor account to earlier GlassWorm activity, but researchers said the connection to the October incident is an inference; no copy of the altered binary was publicly analyzed.

Article Details

Victim Organization
OVHcloud
Incident Type
Software supply-chain compromise: an attacker hijacked a contributor's GitHub account and replaced files in five OVHcloud CLI releases with a build designed to steal secrets.
Incident Date
2026-10-19
Disclosure Date
2026-10-19
Data Types Exposed
  • Secrets stored on disk, potentially including OVHcloud API credentials
Affected Records
Unknown
Affected Data Size
Unknown; OVHcloud did not report how many copies were downloaded, and the files accessed or transmitted by the malicious build are unknown.
Operational Impact
Six files were replaced in each of five releases, v0.11.0 through v0.15.0. The swapped files were available for up to 94 minutes and could reach people who installed or updated the CLI during that period on macOS, Linux x86_64 or arm64, and Windows x86_64. OVHcloud removed the files and published a clean v0.16.0 release.
Ransom Or Extortion
None reported
Claim Status
confirmed

People

Octave KlabaOVHcloud founder who posted advice for affected users to change secrets stored on their disks and described the release-immutability issue.

Malware

GlassWormOpenSourceMalware ties the account to GlassWorm, the malware campaign that hides code in invisible Unicode characters and fetches its next stage from the memo field of a Solana wallet's transactions. Four of the

Vendors

GitHubAn attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were aOVHcloudused a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build

Products

OVHcloud CLIfor up to 94 minutes, from 12:47 to 14:21 UTC, and reached only people who installed or updated the OVHcloud CLI during that window, via a path that checks for no hash, on macOS, Linux x86_64 or arm64, or Windows

Related Articles