Hijacked account: five OVHcloud CLI releases swapped for secret-stealing malware

On Monday, October 19, someone gained access to the GitHub account of an OVHcloud contributor and replaced the program archives on five already-published releases of the provider's command-line tool. The new files were a build designed to steal secrets stored on the disk of any machine that ran it.

The swapped archives stayed on GitHub for up to 94 minutes — from 12:47 to 14:21 UTC — and reached only those who installed or updated OVHcloud CLI during that window, via a path that checks no hash, on macOS, Linux (x86_64 or arm64) or Windows x86_64.

What was compromised

Releases v0.11.0 through v0.15.0, published between April 14 and September 16, were affected; v0.10.0 is clean. On v0.15.0 the attacker swapped six files, including checksums.txt, so the published hashes matched the new binaries. The Linux i386, Windows i386, Windows arm64 and WebAssembly builds were left alone.

You got a tainted build if you ran the official install script, downloaded an archive from a release page, pulled it into CI without a pinned hash, or used the CLI's own upgrade command. Installs via Homebrew (whose cask pinned the SHA-256 and refused a mismatch), go install, source builds and the Docker image were all safe. The source code, release tags and build pipeline were never touched.

How to tell

The swap was caught by a customer whose CI pinned the Linux arm64 archive hash and started failing. He pulled the build info with go version -m, which reads the file without running it. The bad build is marked by a pseudo-version dated October 13, a foreign commit (5ead8ef instead of the 760fd72 the tag points to), and a -ldflags="-s -w" line absent from genuine OVHcloud releases.

What to do

OVHcloud founder Octave Klaba urged everyone affected to change every secret stored on disk — the tool keeps API credentials in ~/.ovh.conf. Researchers at OpenSourceMalware advise doing it from a different machine. That evening the company shipped a clean v0.16.0 as an immutable release, whose files GitHub will not let anyone rewrite.

The root cause was the release-immutability option, available since October 2025, not being enabled: anyone with the right permissions could change the files directly, bypassing CI/CD. It has now been switched on.

OpenSourceMalware ties the hijacked account to GlassWorm, the campaign that hides code in invisible Unicode characters and fetches its next stage from the memo field of a Solana wallet's transactions. No direct link between the October build and GlassWorm has been established — no copy of the malicious archive was preserved publicly. OVHcloud has promised a detailed postmortem in the coming days.

Source: The Hacker News