Info-stealer slipped into OVHcloud CLI GitHub releases
Original title: Info-stealing malware slipped into OVHcloud CLI releases on GitHub
Tampered builds v0.11.0 through v0.15.0 were live for under two hours on October 19; v0.16.0 is clean.
OVHcloud said a compromised developer GitHub account replaced binaries in five open-source CLI releases, v0.11.0 through v0.15.0, on October 19. The malicious files were online from 14:47 until 16:21. CEO Octave Klaba said the added binary retrieves secrets from disk and that CI/CD was not involved because GitHub release immutability had been off. OpenSourceMalware attributes the account compromise to GlassWorm indicators, while calling the link to this October attack its own inference. Users who ran a tampered install are told to change every secret on that machine.
Unconfirmed: The payload was not analyzed, and OpenSourceMalware says the GlassWorm link to the October attack is an inference.
- v0.10.0 was unaffected and the new v0.16.0 release is clean.
- install.sh, Homebrew cask and GitHub tarball installs on macOS, Linux and Windows were exposed.
- Docker images and builds from source were not affected.
- The contributor account had been compromised for about seven months.
- OVHcloud deleted the files before the payload could be archived and analyzed.
Impact: information-stealing malware on machines that ran the CLI
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | v0.11.0 through v0.15.0 | v0.16.0 |
- 1.Update to v0.16.0 or delete CLI copies downloaded during the October 19 window.
- 2.Change every secret stored on machines that ran a tampered v0.11.0 through v0.15.0 build.
- Vendors
- OVHcloud
- Products
- OVHcloud CLI
- Threat actors
- GlassWorm
- Organizations
- OpenSourceMalwareGitHub
- Countries
- France
From the original article
2 min read at helpnetsecurity.com
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the latest CLI release that day to update the tool or delete it. According to Klaba, five versions of the CLI were modified, from v0.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.