OVHcloud GitHub account used to ship malicious CLI binaries
Original title: OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
Poisoned ovhcloud-cli releases were online for 1 hour 33 minutes and downloaded about 250 times.
OVHcloud said attackers used a developer GitHub account compromised months earlier to replace releases of its open-source ovhcloud-cli tool with malicious binaries. CEO Octave Klaba said the added binary retrieves secrets from disk and urged users who downloaded the latest version to update again quickly or delete it and change secrets. The company said the binaries were available for 1 hour 33 minutes. Dark Reading ties the incident to GlassWorm, a self-propagating malware and botnet that has targeted software supply chains since October 2025.
Unconfirmed: The link to GlassWorm is described as the attack being tied to those actors, not as confirmed attribution by OVHcloud.
- Malicious binaries were downloaded about 250 times, OVHcloud said.
- A GitHub user reported suspicious activity after downloading a poisoned build on Monday.
- OVHcloud investigated the ovhcloud-cli repository and removed the malicious releases.
- Klaba said the binary quality is poor but it can retrieve secrets from disk.
Impact: Malicious CLI binaries can retrieve secrets from disk
| Product | Affected |
|---|---|
| ovhcloud-cli | latest version replaced for 1 hour 33 minutes |
- 1.Update or delete the latest ovhcloud-cli if it was downloaded.
- 2.Change all secrets stored on disk if the poisoned tool was used.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
8 min read at darkreading.com
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
By Rob Wright · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.