OVHcloud CLI GitHub releases hijacked to spread secret-stealing malware
Original title: Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware
Malicious builds of v0.11.0 through v0.15.0 were blocked within 94 minutes; v0.16.0 is the clean replacement.
On October 19, 2026, attackers used a compromised OVHcloud developer GitHub account to publish malicious binaries in official OVHcloud CLI releases. CEO Octave Klaba said the added program was meant to retrieve secrets from disk. A customer reported the changes, and OVHcloud blocked the files and found no other affected repository. Users who downloaded the CLI during the window are told to update or delete it and rotate secrets stored on disk.
Unconfirmed: OVHcloud has not said how the account was compromised, which files were searched, where data was sent, or how many users ran the downloads.
- Affected releases were v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0.
- Klaba said v0.10.0 was clean and announced safe release v0.16.0.
- Malicious files appeared at 14:47 and were blocked at 16:21.
- Public issue #300 covered replaced assets for v0.13.0 through v0.15.0.
- The CLI can store credentials in a local .ovh.conf file and environment variables.
Impact: Malware intended to retrieve secrets stored on disk
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | v0.11.0, v0.12.0, v0.13.0, v0.14.0, v0.15.0 | v0.16.0 |
- 1.Update the OVHcloud CLI to v0.16.0 or delete affected downloads.
- 2.Change all secrets stored on disk on machines that ran the files.
- 3.Identify hosts that ran affected releases and review related account activity.
- Vendors
- OVHcloud
- Products
- OVHcloud CLI
- Victims
- OVHcloud
From the original article
3 min read at cybersecuritynews.com
Hackers compromised the GitHub account of an OVHcloud developer and used it to distribute malicious files through the company’s official command-line tool releases. The October 19, 2026, supply chain attack targeted users downloading the OVHcloud CLI, with malware designed to collect secrets stored on their computers. A customer spotted suspicious release changes and alerted the […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.