OVHcloud CLI releases 0.11.0–0.15.0 backdoored on GitHub to steal secrets
Original title: OVHcloud CLI releases backdoored on GitHub to steal developer secrets
A hijacked GitHub account pushed trojanized binaries for about 90 minutes on October 19; 0.10.0 and 0.16.0 are clean.
OVHcloud says an attacker used a compromised developer GitHub account to alter CLI releases 0.11.0 through 0.15.0 so they steal secrets from disk. CEO Octave Klaba said the bad release appeared at 14:47 on October 19 and was blocked at 16:21. Source builds and Docker images were unaffected. OpenSourceMalware links the account to GlassWorm but did not analyze this payload.
Unconfirmed: OpenSourceMalware says the attack was likely GlassWorm but did not analyze this payload.
- Compromised versions are v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0.
- Release immutability was off, so releases could change without CI/CD checks.
- Binaries target macOS, Linux and Windows; source builds and Docker stayed clean.
- Users who ran an affected binary should treat machine secrets as compromised.
Impact: steal secrets stored on disk
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | 0.11.0 through 0.15.0 | 0.16.0 |
- 1.Update to OVHcloud CLI 0.16.0 or remove the compromised package
- 2.Clean affected systems and revoke secrets stored on disk
- Vendors
- OVHcloud
- Products
- OVHcloud CLI
- Malware
- GlassWorm
- Organizations
- GitHubOpenSourceMalware
From the original article
2 min read at bleepingcomputer.com
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.