OVHcloud CLI supply-chain attack: a hijacked contributor GitHub account swapped the download archives of five old releases (v0.11.0 to v0.15.0) for a secret-stealing build for about 94 minutes on 19 October; clean v0.16.0 is out and anyone who ran a swapped build should rotate every secret on that machine
OVHcloud founder Octave Klaba disclosed on 19 October 2026 that an attacker used a compromised contributor's GitHub account to tamper with the releases of the company's open-source command-line tool (ovhcloud-cli), which admins and developers use to manage OVHcloud services. The attacker replaced the macOS (x86_64 and arm64), Linux (x86_64 and arm64) and Windows x86_64 archives, plus checksums.txt so the hashes matched, on existing releases v0.11.0 through v0.15.0; v0.10.0 and the new v0.16.0 are clean. The swapped files were live from 12:47 to 14:21 UTC (14:47 to 16:21 Paris; 20:47 to 22:21 Perth) until a customer whose CI pins the archive hash noticed the mismatch and filed a public GitHub issue. Exposure is limited to people who, in that window, ran the official install script (which checks no hash), downloaded a release archive, ran an unpinned CI download, or ran the CLI's own upgrade command; Homebrew (pinned hashes), go install, source builds and the Docker image were not affected, and copies installed before the window are original. Klaba says the build was poor quality but built to pull secrets off the disk, the source code, tags and CI/CD pipelines were not touched, and the root cause was that GitHub release immutability was not enabled, so a privileged account could re-upload release files; OVHcloud has now enabled it and promised a postmortem. OpenSourceMalware links the contributor account, compromised since at least March, to the GlassWorm campaign through a Solana-memo loader, which it calls an inference; no copy of the swapped binary has been analysed publicly. The OVHcloud CLI stores API credentials in ~/.ovh.conf. Primary: Octave Klaba on X; wires: BleepingComputer and The Hacker News (20 Oct).
- Product
- OVHcloud CLI (ovhcloud-cli) release archives on GitHub
- Versions
- Swapped archives on v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0 (macOS x86_64/arm64, Linux x86_64/arm64, Windows x86_64) downloaded 12:47 to 14:21 UTC on 19 Oct 2026. Clean: v0.10.0, v0.16.0, Homebrew, go install, source builds, Docker image.
- Exploited in Australia?
- unknown
- Patch to
- If you installed or upgraded the OVHcloud CLI on 19 Oct between 12:47 and 14:21 UTC (20:47 to 22:21 Perth) by script, release download, unpinned CI job or the built-in upgrade, or cannot tell: from a different, clean machine rotate every secret readable on the affected host (OVHcloud API keys in ~/.ovh.conf and environment variables, cloud, SSH, Git and CI tokens), then remove the binary and install v0.16.0 and check it with gh release verify-asset. The only published bad hash is the v0.15.0 Linux arm64 archive SHA-256 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb. Pin download hashes in CI, and if you publish software on GitHub, turn on release immutability.
Primary: Octave Klaba (OVHcloud founder) on X — OVHcloud CLI repository compromised; v0.11.0 to v0.15.0 affected (19 Oct 2026); follow-up: x.com/olesovhcom/status/2112280116017471626 · Vendor: OVHcloud CLI v0.16.0 (clean, immutable release, 19 Oct 2026); detection issue: github.com/ovh/ovhcloud-cli/issues/300 · The Hacker News — Hackers hijack five OVHcloud CLI releases to distribute secret-stealing malware (20 Oct 2026); also BleepingComputer and OpenSourceMalware · BleepingComputer — OVHcloud CLI releases backdoored on GitHub to steal developer secrets (20 Oct 2026)