Overview
- OVHcloud's official CLI releases v0.11.0–v0.15.0 were replaced with a binary that steals secrets from disk, a change that appeared on Monday, October 19 and was removed about 94 minutes later after a customer flagged it.
- Company investigators say a hijacked OVHcloud developer GitHub account was used to overwrite published releases while GitHub release immutability was disabled, and the firm's CI/CD pipelines were not altered.
- Users who installed the CLI via the official install script, Homebrew, or direct GitHub downloads on macOS, 64-bit Linux, or Windows x86_64 during the exposure window are affected, while those who built from source, used go install, or pulled official Docker images were not impacted.
- OVHcloud enabled GitHub release immutability, removed the malicious releases, published a clean v0.16.0, and advised anyone who ran an affected binary to assume their on-disk secrets were compromised and to revoke or change them.
- Researchers at OpenSourceMalware say indicators link the activity to a GlassWorm-like campaign and to earlier account tampering in March 2026, but independent analysts could not retrieve a payload sample before OVHcloud deleted the files so firm attribution and full analysis remain limited.