OVHcloud CLI GitHub repository compromised via developer account to distribute secret-stealing binary
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised release was identified at 14:47 and detected and blocked by 16:21, a 94-minute exposure window. OVHcloud has not yet confirmed how many customers were affected, whether data was exfiltrated, or how the developer account was compromised.
Technical Details
- Affected CLI versions: v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. v0.10.0 and the upcoming v0.16.0 are reported as not compromised.
- The attacker added a binary that searches the disk for secrets. Klaba described it as poor quality but effective for its purpose.
- A customer flagged suspicious activity involving an account named HassenBF, which was not publicly listed as an OVH organization member or repository contributor. The customer also questioned modifications to release assets (a "dirty build") and recommended treating published assets as immutable.
- Initial checks found no other affected repositories. The investigation into the account compromise, the targeted files and possible exfiltration is ongoing.
- The repository did not have private vulnerability reporting enabled, so the customer raised the issue publicly.
Remediation
- Users who downloaded the CLI on 19 October 2026 should update immediately or delete it.
- Rotate all secrets stored on the disk of any affected system, since replacing the executable alone does not complete recovery.
- Treat published release assets as immutable, issue new versions instead of overwriting files, and enable private vulnerability reporting on repositories.
Linha do tempo
-
OVHcloud CLI GitHub repository compromised via developer account to distribute secret-stealing binary
ler a análise desta fonte ocultar
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised release was identified at 14:47 and detected and blocked by 16:21, a 94-minute exposure window. OVHcloud has not yet confirmed how many customers were affected, whether data was exfiltrated, or how the developer account was compromised.
Technical Details
- Affected CLI versions: v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. v0.10.0 and the upcoming v0.16.0 are reported as not compromised.
- The attacker added a binary that searches the disk for secrets. Klaba described it as poor quality but effective for its purpose.
- A customer flagged suspicious activity involving an account named HassenBF, which was not publicly listed as an OVH organization member or repository contributor. The customer also questioned modifications to release assets (a "dirty build") and recommended treating published assets as immutable.
- Initial checks found no other affected repositories. The investigation into the account compromise, the targeted files and possible exfiltration is ongoing.
- The repository did not have private vulnerability reporting enabled, so the customer raised the issue publicly.
Remediation
- Users who downloaded the CLI on 19 October 2026 should update immediately or delete it.
- Rotate all secrets stored on the disk of any affected system, since replacing the executable alone does not complete recovery.
- Treat published release assets as immutable, issue new versions instead of overwriting files, and enable private vulnerability reporting on repositories.