Incident BriefingsOVHcloud CLI release compromise

OVHcloud CLI release compromise

Malicious CLI downloads targeted local secrets and developer data.

Last modified

Summary

  • Environment: OVHcloud CLI releases on GitHub
  • Operational impact: Tampered downloads removed; clean version released
  • Financial impact: No total incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 21, 2026; updated as evidence emerges.

What happened

OVHcloud said a compromised developer GitHub account replaced CLI binaries for versions 0.11.0–0.15.0 on October 19, 2026. [1]

Impact

The affected download window was 14:47–16:21 UTC+2. The malware collected cloud credentials, SSH keys and developer-assistant data. Approximately 250 downloads were recorded, not 250 confirmed victims. OVHcloud said source code and its build chain were unaffected. [1]

Timeline

  1. Malicious releases removed

    OVHcloud removed the binaries and released clean version 0.16.0.

    [1]

  2. Technical advisory published

    The advisory documented the compromise.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on October 21, 2026.

Threat Group & Attack Vector

OVHcloud traced the account compromise to a malicious extension installed on a personal computer in October 2025. It said stolen keys enabled the release replacement. [1]

Actors

  • The advisory links an earlier extension wallet to Glassworm; the October operator remains unconfirmed. [1]

TTPs

Response

OVHcloud suspended the account and enabled immutable releases. Users who ran affected downloads were told to replace secrets, remove the binary and upgrade. [1]