Cybersecurity
OVHcloud CLI releases tampered with on GitHub
OVHcloud said attackers took over a developer’s GitHub account, altered several CLI releases and inserted malware aimed at collecting secrets before the problem was detected and blocked.
- OVHcloud said attackers gained access to its open-source CLI repository by taking over a developer’s GitHub account and changed versions 0.11.0 through 0.15.0.
- Octave Klaba said the altered release appeared at 14:47 on 19 October and was blocked at 16:21 after a customer reported it.
- Klaba said version 0.10.0 and version 0.16.0 were not affected, and that the code was meant to collect secrets from disk.
- OpenSourceMalware said the incident was probably part of a GlassWorm campaign and that the GitHub account had been compromised for more than half a year.
OVHcloud said attackers compromised its open-source CLI project and pushed altered releases to GitHub. The company said a developer’s account had been taken over, which let the attacker change versions 0.11.0 to 0.15.0.
Octave Klaba said the compromised release appeared at 14:47 on 19 October and was blocked at 16:21 after a customer reported it. He said version 0.10.0 and version 0.16.0 were not affected.
Klaba said the malicious code was designed to pull secrets from the disk, and told users who had downloaded the affected package to clean their systems and rotate any secrets stored there. He also said GitHub’s setting that prevents release edits had been disabled, which let a sufficiently privileged account alter existing releases.
In a later update, Klaba said the issue had been resolved after OVHcloud enabled that GitHub protection. OpenSourceMalware said the attack was likely part of a GlassWorm operation, that the CI/CD pipelines were not touched, and that the compromised GitHub account had been under hostile control for more than six months.
Named in this story
People
- Octave Klaba
- OVHcloud chief executive who disclosed the incident and its timeline
Companies
- OVHcloud
- warned users after its CLI repository was compromised
- GitHub
- hosted the repository and release settings used in the compromise
Organisations
- OpenSourceMalware
- said the attack was likely tied to a GlassWorm operation
Products and systems
- OVHcloud CLI
- the open-source command-line tool that was altered
- GlassWorm
- the malware operation researchers linked to the incident
How the source tells it
The article is mainly a neutral incident report and remediation notice, with little overt emotive framing.
No emotive framing was found in the original.