Cybersecurity
Attackers swap five OVHcloud CLI releases for malware
An attacker used a hijacked GitHub contributor account to replace archives on five OVHcloud CLI releases with a build that stole secrets from disk, and the files were public for 94 minutes.
- On Monday 19 October, an attacker used a contributor’s GitHub account to replace archives attached to five OVHcloud CLI releases, according to OVHcloud.
- The altered files were available from 12:47 to 14:21 UTC and could reach users who installed or updated the tool on macOS, Linux x86_64 or arm64, and Windows x86_64 through paths that did not check hashes.
- OVHcloud removed the swapped archives and published v0.16.0 that evening as an immutable release.
- The company said the source code, release tag and build pipeline were not changed, and that v0.11.0 through v0.15.0 were compromised while v0.10.0 remained clean.
On Monday 19 October, someone used a contributor’s GitHub account to overwrite the download files attached to five OVHcloud CLI releases, OVHcloud said. The altered archives were online for about 94 minutes, from 12:47 to 14:21 UTC.
The affected path covered installs or updates on macOS, Linux x86_64 and arm64, and Windows x86_64 where no hash check was enforced. OVHcloud said its source code, release tag and build system were unchanged.
OVHcloud deleted the substituted archives and released v0.16.0 later that day as an immutable release. It said users who may have run the bad build should treat secrets stored on that machine as exposed and rotate them.
OpenSourceMalware said the uploads came through a contributor account associated with documentation work and reconstructed the sequence from GitHub server-side records. It also said the account was tied to GlassWorm in earlier work, but described that link as an inference and said no preserved copy of the October binary was available for comparison.
Named in this story
People
- Octave Klaba
- OVHcloud founder who told affected users to change secrets
Companies
- OVHcloud
- the cloud provider whose CLI releases were altered
- GitHub
- the platform where the release archives were replaced
Organisations
- OpenSourceMalware
- researchers who built the timeline and investigated the incident
Products and systems
- OVHcloud CLI
- the command-line tool whose release archives were swapped
- GlassWorm
- the malware campaign OpenSourceMalware linked the account to
How the source tells it
Mostly a factual technical incident report, with a brief urgent advisory section telling users to treat stored secrets as exposed and rotate them.
- urgency repeated mitigation advice telling affected users to rotate secrets, remove the binary and verify downloads