Hijacked developer account planted a stealer in OVHcloud CLI
Original title: Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Releases v0.11.0 through v0.15.0 were replaced for about 94 minutes on October 19; v0.16.0 is clean.
OVHcloud says a hacker used a developer’s GitHub account on October 19 to replace official CLI release binaries with a program that reads secrets from disk. Builds v0.11.0 through v0.15.0 for macOS, 64-bit Linux, and Windows x86_64 were affected; v0.10.0 and v0.16.0 are clean. CI/CD was not changed: GitHub release immutability had been off, so a permitted user could edit published releases. Installs from source, Go, or the official Docker image were not affected.
Unconfirmed: Researchers infer but could not confirm the March compromise and October attack were the same actor; OVHcloud has not mentioned GlassWorm.
- The altered release appeared at 14:47 Paris time and was blocked at 16:21.
- Only common-platform binaries were replaced over already published files.
- Researchers say the contributor account showed tampering since at least March 2026.
- A loader in personal repositories queried Solana via a known GlassWorm wallet.
- OpenSourceMalware did not recover the October payload before the files were deleted.
Impact: Reads secrets from disk on developer and operations machines
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | v0.11.0 through v0.15.0 | 0.16.0 |
- 1.Install clean version 0.16.0, or remain on 0.10.0.
- 2.Treat script, Homebrew, or GitHub installs during the window as exposed.
- 3.Rotate secrets that may have resided on affected workstations.
- Vendors
- OVHcloud
- Products
- OVHcloud CLI
- Malware
- GlassWorm
From the original article
2 min read at securityweek.com
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.