OVHcloud CLI releases 0.11.0-0.15.0 backdoored on GitHub after developer account hijack, stealing secrets from disk
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and blocked at 16:21 after a customer report. The malware's purpose was to retrieve secrets from the disk of affected machines. OpenSourceMalware assesses that the activity is likely a new GlassWorm operation, though it did not analyze the delivered payload. OVHcloud considers the incident resolved, but anyone who ran an affected binary should treat all secrets on the machine as compromised.
Technical Details
- Compromised versions: v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. Version 0.10.0 and the latest 0.16.0 are clean.
- Root cause: GitHub's release immutability setting was disabled, so a sufficiently privileged account could alter existing releases without passing CI/CD checks. OVHcloud states that the CI/CD pipelines (unit and functional tests, CVE detection) were not impacted. OpenSourceMalware confirms the attacker did not tamper with the pipelines and uploaded locally built, infected packages.
- The GitHub account used had reportedly been compromised for more than six months. Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden
preinstall.jsloader that decodes to a second stage using a Solana memo dead drop. The associated wallet is a known GlassWorm indicator. - Affected platforms: macOS (Intel and ARM), Linux (x86_64 and ARM64) and Windows x86-64. Source builds and Docker images were not affected.
Remediation
- Update to 0.16.0 or remove the tool if a compromised version was downloaded.
- Clean the affected system and revoke and rotate all secrets stored on the disk of any machine that ran an affected binary.
- Enable GitHub's release immutability on release repositories (OVHcloud has done so).
Linha do tempo
-
OVHcloud CLI releases 0.11.0-0.15.0 backdoored on GitHub after developer account hijack, stealing secrets from disk
ler a análise desta fonte ocultar
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and blocked at 16:21 after a customer report. The malware's purpose was to retrieve secrets from the disk of affected machines. OpenSourceMalware assesses that the activity is likely a new GlassWorm operation, though it did not analyze the delivered payload. OVHcloud considers the incident resolved, but anyone who ran an affected binary should treat all secrets on the machine as compromised.
Technical Details
- Compromised versions: v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. Version 0.10.0 and the latest 0.16.0 are clean.
- Root cause: GitHub's release immutability setting was disabled, so a sufficiently privileged account could alter existing releases without passing CI/CD checks. OVHcloud states that the CI/CD pipelines (unit and functional tests, CVE detection) were not impacted. OpenSourceMalware confirms the attacker did not tamper with the pipelines and uploaded locally built, infected packages.
- The GitHub account used had reportedly been compromised for more than six months. Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden
preinstall.jsloader that decodes to a second stage using a Solana memo dead drop. The associated wallet is a known GlassWorm indicator. - Affected platforms: macOS (Intel and ARM), Linux (x86_64 and ARM64) and Windows x86-64. Source builds and Docker images were not affected.
Remediation
- Update to 0.16.0 or remove the tool if a compromised version was downloaded.
- Clean the affected system and revoke and rotate all secrets stored on the disk of any machine that ran an affected binary.
- Enable GitHub's release immutability on release repositories (OVHcloud has done so).