Attacker uses a hijacked developer's GitHub account to slip info-stealing malware into OVHcloud's CLI
Versions 0.11.0 through 0.15.0 were tampered with for about an hour and a half on October 19 before a customer raised the alarm.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
OVHcloud, the French cloud and web hosting company, says an attacker used the GitHub account of one of its developers to add a secret-stealing binary to its open-source command-line tool. Founder Octave Klaba said on X that the tampered release went live at 14:47 Paris time on October 19 and was blocked at 16:21, after a customer reported the problem. Versions v0.11.0 through v0.15.0 were modified. Version v0.10.0 is unaffected, and the newly released v0.16.0 is clean. Klaba called the binary's quality poor but said it "can go all the way" in pulling secrets from disk. He advised users who downloaded the latest release that day to update or delete the tool. According to Klaba, OVHcloud's CI/CD pipelines were not affected. The problem was that GitHub's release immutability option had not been turned on, so anyone with the right permissions could change existing releases without passing through those checks. The option has since been enabled. SecurityWeek cites researchers who say the developer's account was compromised in March by a GlassWorm-linked loader. OpenSourceMalware says the tampering was flagged publicly on GitHub after an automated hash check failed. The incident shows how a single compromised maintainer account can bypass a build pipeline's controls.