2026 OVHcloud — five ovhcloud-cli GitHub releases swapped for secret-stealing builds (94 minutes)
Data compromised
Secrets stored on disk of any machine that downloaded and ran a swapped build of ovhcloud-cli v0.11.0–v0.15.0 (macOS/Linux x86_64 and arm64, Windows x86_64) between 12:47 and 14:21 UTC on Oct 19, 2026. Download count not disclosed.
Technical writeup
Verified by OVHcloud (CEO Octave Klaba posts; OVHcloud guidance). Six files per release were replaced on v0.11.0–v0.15.0 (five archives plus checksums.txt); live up to 94 minutes until OVHcloud deleted them at 14:21 UTC after a customer's pinned-hash CI job failed and was reported in GitHub issue #300. Homebrew, go install/source builds and the Docker image were not affected. Clean v0.16.0 published with immutability and attestation. OpenSourceMalware tentatively links the account to GlassWorm (unconfirmed). recordsAffected 0.
Root cause
A hijacked contributor GitHub account with write access replaced download archives on existing releases; release immutability was not enabled. Source, tags and the build pipeline were not modified.
References
- https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
- https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
- https://github.com/ovh/ovhcloud-cli/issues/300
- https://next.ink/262824/le-client-en-ligne-de-commande-dovhcloud-compromis-par-un-pirate-sur-github/