Step Security Reconstructs OVHcloud CLI Release Swap and GlassWorm Loader

Oct 19, 2026 · Original article ↗

Summary

Step Security reports OVHcloud CLI assets for five releases were swapped for a credential stealer in a 94-minute window. Its replay reproduced build fingerprints and loader behavior, identified installation-path differences, and outlines credential-rotation steps.

Key points

Step Security reports that binaries for OVHcloud CLI releases v0.11.0–v0.15.0 were replaced on October 19, 2026, for 94 minutes; about 250 downloads were disclosed.
The report attributes the uploads to GitHub account HassenBF and says the attacker replaced release assets without moving tags, changing source, or running CI.
A rebuild of commit 5ead8ef with the reported build flags reproduced the swapped binary's pseudo-version metadata; `ovhcloud version` displayed `undefined` and the commit hash.
The replay found that install.sh did not verify checksums and generated a nonexistent Linux arm64 asset name. The report says Homebrew's pinned hashes blocked the swapped artifact.
In an isolated chamber, a collection routine matching the advisory's target list staged canary credentials from 18 paths and transmitted an archive; this was a replay, not evidence of actual victim exfiltration.
Step Security recovered and detonated a GlassWorm loader, observing variation-selector-encoded code, Solana-based dead-drop polling, and execution of a fetched stage.
The article advises treating systems that ran swapped binaries as compromised, rotating accessible secrets from a different machine, and reinstalling the clean, attested v0.16.0 release.

Article Details

Attack Vectors: An attacker using the GitHub account HassenBF replaced binaries on five existing OVHcloud CLI releases without moving tags or changing the source repository. The attacker uploaded locally built binaries and replaced checksums.txt on some releases.
According to OVHcloud's postmortem, a developer installed the malicious VS Code extension color-picker-universal 2.8.91 on a personal MacBook in October 2025. It installed a persistent NodeJS service that communicated with 162.33.177[.]177.
In March 2026, four personal repositories associated with the account were force-pushed with hidden preinstall.js loaders using a Solana dead drop to obtain a stage-3 payload.
The swapped CLI binaries collected credentials and configuration data from AI-agent stores, cloud and container tools, SSH, and other local files; staged the data in /tmp/envchecker-* directories; and sent an archive to the reported exfiltration endpoint.
The GlassWorm loader concealed JavaScript using variation-selector characters, decrypted its wrapper, polled Solana RPC providers for transaction-memo C2 configuration, fetched an encrypted stage-3 script, and executed it in a Node vm context.
Defensive Notes: Treat hosts that ran a swapped binary as fully compromised and assume collected secrets were exfiltrated. Rotate all accessible secrets from a different machine and revoke and reissue affected tokens.
Check for /tmp/envchecker-* staging directories, remove the swapped binary and those directories, and rebuild the host if its cleanliness cannot be established.
Install the clean, immutable v0.16.0 release and verify its asset attestation with gh release verify-asset.
Audit CI jobs that fetched releases/download/v0.1[1-5].0/* during the October 19, 2026 exposure window, including credentials available to those runners.
Pin release artifact hashes independently. The article reports that install.sh did not verify checksums, while Homebrew's per-architecture SHA-256 pins rejected the swapped files.
Enable release immutability and verify artifacts against independently trusted hashes or attestations; the article identifies the lack of GitHub release immutability as the mechanical cause of the asset swap.

Indicators of compromise

Type	Indicator	Context
IPV4	`162[.]33[.]177[.]177`	Reported C2 address contacted by the persistent NodeJS service installed through the malicious VS Code extension.
IPV4	`45[.]32[.]148[.]174`	Reported exfiltration server address used by the stealer to receive archived data.
MD5	`01f57206d37c28cf711677f612052913`	MD5 of the malicious Linux_arm64 OVHcloud CLI release binary, as reported from the advisory.
MD5	`301bff0b51980b9e76c93633e7cfd3bd`	MD5 of the malicious Linux_x86_64 OVHcloud CLI release binary, as reported from the advisory.
MD5	`347e65eb7f2d78d1c6872690272a6cc3`	MD5 of the malicious Darwin_x86_64 OVHcloud CLI release binary, as reported from the advisory.
MD5	`6f2f086239f3d88eb2750e871901927d`	MD5 of the malicious Darwin_arm64 OVHcloud CLI release binary, as reported from the advisory.
SHA256	`0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c`	SHA-256 of the decrypted stage-2 script in the GlassWorm loader chain.
SHA256	`3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb`	SHA-256 of the malicious Linux_arm64 OVHcloud CLI release archive.
SHA256	`43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70`	SHA-256 of the recovered malicious preinstall.js loader from orphaned commit 227207ce.
URL	`hxxps[:]//45[.]32[.]148[.]174/upload`	Reported exfiltration endpoint receiving the archive as Solana-RPC-shaped JSON.