An attacker compromised the OVHcloud command-line interface tool on Oct. 19 by hijacking a contributor account to replace legitimate download archives with malicious builds designed to steal local secrets, as first reported by The Hacker News.
The unauthorized files were active on GitHub for up to 94 minutes, affecting users who installed or updated the tool between 12:47 p.m. and 2:21 p.m. UTC. The breach impacted five releases published between April and September. The attacker replaced binaries for macOS, Linux and Windows, while leaving other builds untouched. The malicious code was a plain build of a later commit, uploaded directly to existing releases because OVHcloud had not enabled the immutable releases feature. The company confirmed that the source code and build pipelines remained secure. Impacted users are advised to rotate all secrets stored on their machines and upgrade to the newly released v0.16.0, which is protected by release attestation. Researchers from OpenSourceMalware have linked the compromised account to the GlassWorm malware campaign, noting that the account previously hosted malicious loaders. OVHcloud has since enabled release immutability and is conducting a full investigation into the incident.
Source: The Hacker News
