Hijacked OVHcloud Developer Account Used to Plant Secret-Stealing Binary in CLI

Summary

OVHcloud says a hijacked developer GitHub account was used to replace CLI release files with a secret-stealing binary. Versions 0.11.0–0.15.0 were affected; the company blocked them and enabled release immutability.

Key points

OVHcloud says an attacker used a developer’s GitHub account to add a secret-stealing binary to its official CLI releases.
Versions 0.11.0 through 0.15.0 were compromised; versions 0.10.0 and 0.16.0 were clean.
The compromised release was available for about 94 minutes on October 19 before OVHcloud blocked it after a customer report.
Users who installed or updated through the official script, Homebrew, or direct GitHub downloads on macOS, 64-bit Linux, or Windows x86_64 during that window may be affected.
Source builds, Go’s install command, and the official Docker image were not affected. OVHcloud said its CI/CD pipelines were not impacted.
The incident was possible because GitHub release immutability was disabled; OVHcloud has since enabled the option.
Researchers said the compromised account had earlier been used to rewrite personal repositories, but could not confirm whether the same actor was responsible for both incidents or obtain the payload for analysis.

Article Details

Victim Organization: OVHcloud
Incident Type: Supply-chain compromise: a compromised developer GitHub account was used to replace files in published OVHcloud CLI releases with a secret-stealing binary.
Data Types Exposed: Secrets stored on disk; specific data types and whether any were successfully obtained are not disclosed.
Operational Impact: CLI versions v0.11.0 through v0.15.0 were compromised. The malicious release was available for roughly 94 minutes before being blocked. Users who installed or updated affected versions through the listed methods and platforms may have been affected. CI/CD pipelines were not impacted.
Claim Status: confirmed