Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware.
OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the latest CLI release that day to update the tool or delete it.
According to Klaba, five versions of the CLI were modified, from v0.11.0 through v0.15.0. Version v0.10.0 was unaffected, and the new v0.16.0 release is clean.
The tampered release went live at 14.47 on October 19 and was blocked at 16.21, after a customer reported the problem. “Thanks to the customer who reported the issue to us,” Klaba wrote.
“The hacker used the GitHub account of one of the developers and added a binary whose job is to retrieve secrets from the disk,” he explained, adding that “the quality of the binary is poor but it can go all the way.”
In a follow-up post, Klaba said the company had completed its analysis and that its CI/CD pipelines, including unit tests, functional tests and CVE detection, were not impacted.
“The issue stems from the release immutability option on GitHub, which had not been enabled. As a result, a user with the appropriate permissions could directly modify existing releases on GitHub without any checks from our CI/CD,” Klaba noted.
OVHcloud has since switched the option on and considers the incident closed.
GlassWorm link
OpenSourceMalware, a community-driven threat intelligence platform, ties the attack to the GlassWorm threat actors.
GlassWorm operators have targeted software developers since at least early 2025, drawn by their access to source code repositories, cloud platforms, CI/CD pipelines and package registries. In May 2026, CrowdStrike, Google and the Shadowserver Foundation disrupted the GlassWorm botnet by taking down its four command-and-control channels at the same time.
OpenSourceMalware’s analysis found that the attacker never touched OVHcloud’s CI/CD pipelines. The malicious binary was built on a workstation and uploaded onto five existing GitHub releases, replacing the legitimate files.
The GitHub account behind the uploads belonged to an OVHcloud contributor and had been compromised for about seven months.
In March 2026, someone rewrote the history of several of its personal repositories and planted a hidden loader that fetches its next stage through a Solana blockchain transaction. The wallet used for this is a known GlassWorm indicator, though the analysts say the link between that compromise and the October attack is their own inference.
“This is a release-asset replacement attack,” researchers noted.
“The source repository was never touched, so anyone verifying against the Go module proxy or building from source was fine. But anyone who ran install.sh, brew install –cask ovh/tap/ovhcloud-cli, or downloaded a tarball from GitHub in that window on macOS, Linux x86_64/arm64 or Windows x86_64 got the malware,” they added.
Users who built the CLI from source or pulled the Docker image were not affected.
Anyone who installed one of the tampered versions should change every secret stored on that machine. “If you are affected, please change all the secrets on your disk,” Klaba urged.
OVHcloud deleted the malicious files before anyone could archive them, so OpenSourceMalware has not analyzed the payload. Based on the platforms the attacker chose, the analysts believe “this looks like credential harvesting aimed at developer and ops workstations.”
