Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

What it is

OVHcloud's official CLI on GitHub shipped a secret-stealing binary on 19 October. An attacker used the GitHub account of one OVHcloud developer to upload the binary over existing release files. OVHcloud lists v0.11.0 through v0.15.0 as compromised. v0.10.0 and the new v0.16.0 are clean.

How it works

The attacker replaced files in already published releases. Release immutability was not enabled on the repository, so a user with the right permissions could edit releases directly, with no check from CI/CD. OVHcloud founder Octave Klaba says the pipelines were not affected and the option is now enabled.

Only builds for the most common platforms were replaced. OpenSourceMalware reads this as targeting credential harvesting on developer and operations workstations. Klaba describes the binary as poor quality, but able to retrieve secrets from disk.

The malicious version appeared at 14:47 Paris time and was blocked at 16:21. A customer reported it, and OpenSourceMalware says a user flagged it publicly on GitHub after an automated hash check failed.

Preconditions / Affected

You are affected if you installed or updated the CLI during the roughly 94-minute window, on one of these platforms:

• macOS
• 64-bit Linux
• Windows x86_64

The affected install routes are the official install script, Homebrew, and a direct GitHub download.

These routes are not affected:

• building from source
• Go's install command
• the official Docker image

What to do

The page names no commands, indicators of compromise or credential-rotation steps. What it does establish:

• Check which version of the CLI you have. Anything from v0.11.0 to v0.15.0 is listed as compromised.
• v0.16.0 is the clean release.
• Where you pin or verify release artifacts, a hash check is what exposed this tampering.
• Enable GitHub's release immutability option on your own repositories. A missing setting let this attack skip CI/CD.

Caveats

OpenSourceMalware could not get a payload sample before OVHcloud deleted the files, so what the stealer collects is unanalyzed.

The researchers say the same account was compromised by at least March 2026, when four personal repositories were rewritten and three received a hidden loader. That loader's next stage queries the Solana blockchain for a further payload, using a wallet that is a known GlassWorm indicator. The researchers could not confirm one actor did both, calling it "our inference". OVHcloud has not mentioned GlassWorm.