GlassWorm Compromises OVH CLI as GhostAction Adopts Fake-Font Malware
Summary
Researchers discuss GlassWorm's compromise of four OVH CLI versions, malware split across packages, and GhostAction's use of fake-font credential stealers that persist beyond removal of malicious GitHub workflows.
Key points
- Researchers attributed four compromised OVH CLI versions to GlassWorm, linking the contributor account to malicious repository pushes on March 5, seven months earlier. The credential-theft date remains unknown.
- The malicious CLI builds reportedly came from a contributor's laptop rather than the normal CI pipeline. A user noticed suspicious behavior; researchers later reported lingering malicious pre-install scripts despite announced incident response.
- Compound payloads distribute functionality across packages to evade per-package detection. Researchers identified webrunc as a possible component, not a package containing a complete malicious payload.
- Researchers described Contagious Interview delivery through private repositories whose .npmrc configuration selects an alternative registry, allowing malicious dependencies to resolve within the target's project environment.
- Git forensics linked GhostAction's malicious workflows to subsequent fake-font payload additions. Shared attacker infrastructure and the repository timeline supported attribution despite similarities to PolinRider.
- The fake-font JavaScript targets developer credentials and SSH private keys, then installs a cron job that checks in every five minutes. Researchers said the stealer only partly works and found one maintainer had removed malicious workflows but missed this payload.
- The hosts recommended auditing CI workflows and their external dependencies, emphasizing that removing malicious workflows alone may leave additional repository malware and persistence.
Article Details
- Attack Vectors
- GlassWorm reportedly used a compromised contributor account to publish four malicious OVH CLI versions outside the normal CI pipeline. Paul McCarty identified initial malicious repository pushes on March 5 but said the credential-theft date was unknown.
- Compound payloads distribute functionality across multiple packages so individual components remain below detection thresholds. Researchers described webrunc as a possible component, not a confirmed standalone malicious package.
- In the reported Contagious Interview activity, job-themed LinkedIn outreach leads targets to private repositories whose .npmrc redirects dependency resolution to a different registry, enabling delivery of malicious packages only in the configured repository environment.
- GhostAction used previously planted malicious GitHub Actions workflows to add VS Code tasks that execute JavaScript disguised as a font file when developers open compromised repositories.
- The GhostAction payload attempts to collect credential files and SSH private keys and installs a cron callback every five minutes. Researchers reported that the stealer only partially works.
- GhostAction also reportedly phished open source maintainers using a lookalike domain.
- Defensive Notes
- Audit CI workflows, action versions, external containers, and the credentials and source code exposed to each stage; revisit copied or long-standing workflow configurations.
- Sign commits and require signed commits where supported; the speakers cautioned that signing alone does not address malicious workflow execution.
- Monitor releases built or published outside the established pipeline; the speakers linked the unusual OVH CLI build provenance to rapid discovery.
- Inspect compromised repositories for added VS Code tasks and fake font payloads, and check developer systems for persistence. Removing malicious workflows alone did not remove GhostAction's additional malware.
- Evaluate dependencies and runtime retrieval behavior together rather than relying only on isolated package signals, because compound payloads can distribute suspicious functionality across packages.
- Investigate lingering contributor-account compromise during incident response. McCarty reported that malicious pre-install content remained in the contributor's repositories after OVH announced incident response.
MITRE ATT&CK
T1036 · MasqueradingGhostAction disguises executable JavaScript as a .woff2 font payload using a path copied from PolinRider.T1053.003 · CronGhostAction's developer-targeting payload installs a cron job that contacts attacker infrastructure every five minutes.T1059.007 · JavaScriptGhostAction's VS Code tasks execute JavaScript stored in a fake font file.T1078 · Valid AccountsGlassWorm reportedly reused a compromised OVH CLI contributor account that remained usable months after initial malicious repository pushes.T1195.002 · Compromise Software Supply ChainGlassWorm published four compromised OVH CLI versions; GhostAction also planted executable payloads in repositories through malicious workflows.T1552.001 · Credentials In FilesGhostAction's stealer reads credential files for AWS, PyPI, NPM, Git, Claude, Gemini, and Kubernetes and searches the home directory for matches.T1552.004 · Private KeysGhostAction's stealer explicitly reads SSH private keys.T1566.003 · Spearphishing via ServiceReported Contagious Interview activity uses LinkedIn job outreach to invite targets into private repositories that deliver malicious dependencies.
People
HassenBFOVH CLI contributor whose account was reportedly compromised and used for malicious repository pushes; the source does not establish when the credentials were stolen.Jenn GileAnalyzed GhostAction repository history and described how malicious workflows preceded the fake-font payload additions.Paul McCartyInvestigated the OVH CLI compromise and described compound payloads and private-registry delivery in Contagious Interview activity.ThijsJamf community member who identified roughly 94 compromised repositories and noticed GhostAction infrastructure in apparent PolinRider-style payloads.
Threat Actors
GhostActionAttributed by Jenn Gile to malicious workflows, maintainer phishing, and fake-font credential-stealing payloads added to compromised repositories.GlasswormDescribed by the speakers as a Russian threat actor responsible for the compromised OVH CLI releases after an earlier infrastructure takedown.PolinRiderDescribed as using fake-font payloads and VS Code execution patterns that GhostAction copied; the speakers associated its activity with DPRK.
Vendors
Products
GitHub Actions[00:05:16] Paul McCarty: Um, and, uh, yeah, the rest, as they say, is history. This did not happen in GitHub Actions. These were built, um, if I’m, I’m, I hope I’m not mistaking the two, but if I remember correctly, um,OVHcloud CLIOVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool.VS Codetrick in repos already compromised with the malicious workflows. Anyone who opens one of those repos in VS Code runs a credential stealer and gets a cron job that checks in with the attacker every five minutes.
Countries
DPRKthey run together, and the purpose is to evade detection because each piece looks harmless on its own. DPRK is using a similar approach in Contagious Interview, in which a private repo’s .npmrc points to aRussianOVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool.