OVHcloud CLI Compromised: Infostealer Distributed Through Hijacked GitHub Releases for 25 Minutes
On October 19, the official OVHcloud CLI tool was compromised when an attacker used a hijacked developer account to replace binaries in five existing releases from v0.11.0 to v0.15.0. The attack lasted from 15:47 to 16:12 Moscow time, with the infostealer targeting API keys, SSH keys, and other secrets stored on developer and CI machines. The malicious binaries were uploaded directly via the GitHub Releases API, and the checksums.txt file was also replaced to match the tampered archives. Only users who had hardcoded the original SHA-256 hash in their CI pipelines, such as one customer who opened issue #300, detected the tampering when builds failed. The compromised account HassenBF had been infected with GlassWorm malware since March 2025, allowing persistent access until the October attack. OVH responded by deleting the malicious files at 17:21 and releasing v0.16.0 with immutable releases and attestation enabled.
HabrOct 20, 2026Translated from Russian