AppSec · 3h ago
OVHcloud said a hijacked GitHub contributor account replaced download archives for five existing OVHcloud CLI releases with secret-stealing builds for 94 minutes on October 19, from 12:47 to 14:21 UTC. The affected versions were v0.11.0 through v0.15.0.
The attacker also replaced the checksum file with hashes matching the malicious binaries, so checking the checksum published alongside a download could still say it was valid. The source repository, release tags, and build pipeline were untouched. People who downloaded and ran an affected archive during the window may have exposed secrets stored on their machines.
If a workstation or CI runner fetched and ran one of these archives without an independently pinned hash, its local secrets may have been exposed. The reporting does not establish what data, if any, was accessed.
2 sources covering this story
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
Attackers replaced OVHcloud CLI downloads across five GitHub releases with secret-stealing builds for up to 94 minutes on October 19.
Part of the PlainSec briefing for 2026-10-20