Hijacked GitHub account swapped OVHcloud CLI releases with a stealer
October 21: later reports add about 250 downloads, GlassWorm-indicator claims dating to March, and a caveat that the payload link is inferred.
OVHcloud removed tampered CLI releases v0.11.0–v0.15.0 after a short October 19 window and published clean v0.16.0.
On October 19, 2026, OVHcloud said a hijacked contributor GitHub account replaced CLI archives v0.11.0 through v0.15.0 with a binary meant to steal secrets stored on disk. The files were live about 94 minutes on selected macOS, Linux, and Windows paths that do not verify a hash; source, Go, and official Docker installs were unaffected. The Hacker News says Homebrew was not exposed; Help Net Security says Homebrew cask installs were. Release immutability was off, so CI/CD was unchanged; OVHcloud removed the files, found no other affected repository, published clean v0.16.0, and told users who ran a tampered build to rotate secrets. According to OpenSourceMalware, the account shows GlassWorm indicators, but the link to this deleted payload is an inference; Dark Reading reports about 250 downloads.
- Window was 12:47–14:21 UTC, also given as 14:47–16:21 Paris time.
- On v0.15.0, checksums.txt was replaced so published hashes matched the binaries.
- Only published swapped hash is v0.15.0 Linux arm64 SHA-256 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb.
- A customer report named account HassenBF; issue #300 covered v0.13.0 through v0.15.0.
- Researchers say the contributor account showed tampering since at least March 2026.
- OVHcloud has not confirmed how many customers or credentials were affected.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026Tampered CLI archives went live around 12:47 UTC. · The Hacker News
- Oct 19, 2026OVHcloud blocked the malicious files by 14:21 UTC. · The Hacker News
What each outlet adds
beyond the shared facts- The Hacker NewsUTC times, checksum swap, arm64 hash, Homebrew not exposed.
- Help Net SecuritySays Homebrew cask installs were exposed; payload link is inferred.
- SecurityWeekParis times, March tampering, Solana GlassWorm wallet loader.
- Dark ReadingAbout 250 downloads and a 1 hour 33 minute window.
- GBHackersCustomer report named account HassenBF; no victim count confirmed.
- Vendors
- OVHcloud
- Products
- ovhcloud-cliOVHcloud CLIGitHub
- Threat actors
- GlassWorm
- Malware
- GlassWorm
- Victims
- OVHcloud
- Organizations
- GitHubOpenSourceMalware
- Countries
- France
Coverage
oldest first · one row per article · UTC- · 5d ago
The Hacker NewsFirst report
Hijacked account swapped five OVHcloud CLI releases with a secret-stealer
The swapped archives were live for up to 94 minutes on October 19 and only reached unhashed installs on selected platforms.
- · 5d ago
Cyber Security News
OVHcloud CLI GitHub releases hijacked to spread secret-stealing malware
Malicious builds of v0.11.0 through v0.15.0 were blocked within 94 minutes; v0.16.0 is the clean replacement.
- · 5d ago
GBHackers
OVHcloud CLI GitHub releases briefly served a secret-stealing binary
Compromised builds v0.11.0 through v0.15.0 were online for 94 minutes on October 19 before OVHcloud blocked them.
- · 5d ago
BleepingComputer
OVHcloud CLI releases 0.11.0–0.15.0 backdoored on GitHub to steal secrets
A hijacked GitHub account pushed trojanized binaries for about 90 minutes on October 19; 0.10.0 and 0.16.0 are clean.
- · 4d ago
SecurityWeek
Hijacked developer account planted a stealer in OVHcloud CLI
Releases v0.11.0 through v0.15.0 were replaced for about 94 minutes on October 19; v0.16.0 is clean.
- · 4d ago
Help Net Security
Info-stealer slipped into OVHcloud CLI GitHub releases
Tampered builds v0.11.0 through v0.15.0 were live for under two hours on October 19; v0.16.0 is clean.
- · 4d ago
Dark Reading
OVHcloud GitHub account used to ship malicious CLI binaries
Poisoned ovhcloud-cli releases were online for 1 hour 33 minutes and downloaded about 250 times.