OVHcloud CLI archives served secret-stealing malware for 94 minutes
OVHcloud said a hijacked GitHub contributor account replaced download archives for five existing OVHcloud CLI releases with secret-stealing builds for 94 minutes on October 19, from 12:47 to 14:21 UTC. The affected versions were v0.11.0 through v0.15.0.
The attacker also replaced the checksum file with hashes matching the malicious binaries, so checking the checksum published alongside a download could still say it was valid. The source repository, release tags, and build pipeline were untouched. People who downloaded and ran an affected archive during the window may have exposed secrets stored on their machines.
If a workstation or CI runner fetched and ran one of these archives without an independently pinned hash, its local secrets may have been exposed. The reporting does not establish what data, if any, was accessed.
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.