OVHcloud CLI Supply Chain Attack Compromised Versions 0.11.0 Through 0.15.0
A hijacked developer account was used to inject a credential-stealing binary into the official OVHcloud command-line interface tool between October 19 and early afternoon.
Key points
- OVHcloud confirmed that CLI versions v0.11.0 through v0.15.0 were compromised via a hijacked GitHub developer account.
- The malicious binary was active for approximately 94 minutes before being blocked following a customer report.
- Security researchers linked the account compromise back to March 2026 and identified GlassWorm indicators in the loader.
OVHcloud disclosed on October 19 that a threat actor used a compromised GitHub account belonging to one of its developers to insert a secret-stealing binary into its official command-line interface tool. The French cloud hosting provider stated that versions v0.11.0 through v0.15.0 are affected by this supply chain incident.
The malicious release appeared at 14:47 Paris time and was taken offline at 16:21 after a customer reported suspicious activity. Founder Octave Klaba noted on X that the binary, while of poor quality, was capable of retrieving secrets from the disk. Version 0.10.0 and the newly released version 0.16.0 remain clean and unaffected by the intrusion.
Context and Background
According to OpenSourceMalware, a user publicly flagged the tampering on GitHub after an automated hash check failed to match expected values. The attacker uploaded the malicious binary over the original files of already published releases, replacing only builds for the most common platforms. This selective replacement suggests the attacker focused on credential harvesting from developer and operations workstations.
Klaba explained that the company’s CI/CD pipelines were not impacted because the issue stemmed from GitHub’s release immimutability option not being enabled. This allowed a user with appropriate permissions to modify existing releases directly without checks from the continuous integration system. The option has since been enabled to prevent similar direct modifications.
Researchers stated that the compromised account belonged to a legitimate OVHcloud contributor and had been hijacked since at least March 2026. During that earlier breach, four personal repositories were rewritten, with three including a hidden loader. The loader’s next stage queries the Solana blockchain for further payloads using a wallet known as a GlassWorm indicator.
Who Is Affected
Users who installed or updated the OVHcloud CLI on macOS, 64-bit Linux, or Windows x86_64 during the roughly 94-minute window are potentially affected. The infection vector includes installations via the official install script, Homebrew, or direct downloads from GitHub. OpenSourceMalware noted that they could not obtain a sample of the payload for analysis before OVHcloud deleted the malicious files.
Researchers could not confirm that the same actor behind the March account compromise was responsible for the October attack. They described the connection as an inference based on the shared compromised account and similar tactics. OVHcloud has not mentioned the GlassWorm threat group in its official statements regarding the incident.
What should you do?
Organizations should verify the version of the OVHcloud CLI currently installed on their systems and ensure it is updated to version 0.16.0 or later. Administrators should review logs for any unexpected network connections or data exfiltration attempts originating from systems that may have run the compromised versions during the exposure window.
Background: CI/CD pipeline vulnerabilities
Inspect build agent logs for unexpected network connections, unusual file writes and credential usage patterns. Correlate these signals with artifact repository changes. Use static analysis on pipeline definition files to catch insecure configurations before execution.
Read the full guide: Detect CI/CD Pipeline Vulnerabilities: Signals, Blind Spots and Tools
What to do and how to stay safe: OVHcloud
- Verify that your OVHcloud CLI installation is version 0.16.0 or higher; downgrade or reinstall if you are running versions 0.11.0 through 0.15.0.
- Rotate any credentials, API keys, or secrets stored on systems that may have executed the compromised CLI binary during the 94-minute window.
- Monitor network traffic for connections to Solana blockchain endpoints or other unusual outbound queries that may indicate loader activity.
- Review GitHub release settings to ensure release immutability is enabled to prevent direct modification of published assets.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which OVHcloud CLI versions are confirmed to be compromised?
OVHcloud has identified versions v0.11.0 through v0.15.0 as compromised; versions 0.10.0 and 0.16.0 are clean.
How long was the malicious binary available for download?
The compromised release was available for approximately 94 minutes, from 14:47 to 16:21 Paris time on October 19.
Is this attack linked to the GlassWorm threat group?
Researchers identified GlassWorm indicators in the loader but stated they could not confirm if the same actor was behind both the March compromise and the October attack.
