OVHcloud GitHub Releases Compromised to Distribute Secret-Stealing Malware
Hackers infiltrated an OVHcloud developer's GitHub account, injecting secret-stealing malware into official CLI tool releases, impacting versions v0.11.0 through v0.15.0.
OVHcloud, a major cloud provider, has become the latest victim of a supply chain attack after threat actors compromised the GitHub account of one of its developers. This breach allowed attackers to inject malicious files into the official OVHcloud Command Line Interface (CLI) tool releases, specifically targeting users who downloaded versions v0.11.0 through v0.15.0 between October 19, 2026. The malware was designed to exfiltrate secrets stored on compromised systems.
The incident came to light when a vigilant customer noticed suspicious changes in the release files and promptly alerted OVHcloud. The company acted swiftly, blocking the malicious files within 94 minutes of detection. OVHcloud CEO Octave Klaba confirmed that versions v0.11.0 to v0.15.0 were affected, while v0.10.0 remained clean. A secure version, v0.16.0, has since been released and is available on the project's GitHub releases page, marked as immutable.
According to Klaba's account, the malicious files were introduced at 14:47 and identified and blocked by 16:21 on October 19th. Initial investigations by OVHcloud indicated that no other repositories within the company's GitHub organization were affected, limiting the confirmed scope of the breach to the CLI project. The attackers exploited the trust associated with official software distribution channels, making it difficult for users to suspect the integrity of a routine CLI update.
The exact method by which the developer's GitHub account was initially compromised has not yet been disclosed by OVHcloud. The customer's report highlighted concerns about release files being replaced with a "dirty build," a term often indicating unauthorized modifications beyond the recorded source revision. The public issue report, identified as #300, specifically addressed replaced assets for versions v0.13.0 through v0.15.0, with OVHcloud later naming two additional affected versions.
The injected program was described as a binary capable of retrieving secrets from disk. While its code quality was noted as poor, it was still deemed capable of achieving its objective. Details regarding the specific files targeted by the malware, the destination for exfiltrated data, or the number of users who executed the malicious downloads remain undisclosed pending further investigation by OVHcloud.
The OVHcloud CLI tool is essential for managing cloud services, account resources, and automating workflows. It supports various authentication methods, including local credential files and environment variables for application keys and secrets. The compromise of such a tool poses a significant risk, as it could potentially grant attackers access to sensitive cloud credentials and other secrets stored locally on developer machines.
OVHcloud has advised all users who downloaded the CLI during the affected period to update to the latest secure version immediately or remove the tool. Furthermore, users are strongly urged to rotate all secrets stored on their disks, as previously compromised credentials may still be valid. Organizations should investigate which machines may have downloaded and executed the malicious files, preserve any relevant evidence, and review account activity associated with potentially exposed credentials.
This incident aligns with a broader trend of attackers leveraging trusted software update mechanisms and developer tools to distribute malware and steal credentials. The compromise of official repositories and distribution channels bypasses many traditional security measures, underscoring the critical importance of robust supply chain security and vigilant monitoring of software integrity.
The incident involved the hijacking of a GitHub contributor account, which was then used to replace download archives for five OVHcloud CLI releases between April and September. The malicious files were available for up to 94 minutes, potentially exposing users who downloaded them during that window. OVHcloud has since released an immutable v0.16.0 version and advised affected users to change all secrets stored on their disks.