--- title: "OVHcloud CLI release compromise" description: "OVHcloud removed malicious CLI releases after a compromised GitHub account replaced downloadable binaries." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-21" canonical_url: "https://www.ally.security/incidents/ovhcloud-cli-release-compromise-2026" markdown_url: "https://www.ally.security/incidents/ovhcloud-cli-release-compromise-2026.md" stix_url: "https://www.ally.security/incidents/ovhcloud-cli-release-compromise-2026/stix.json" --- # OVHcloud CLI release compromise Malicious CLI downloads targeted local secrets and developer data. Last modified Oct 21, 2026 · 1 source ## Summary - **Environment:** OVHcloud CLI releases on GitHub - **Operational impact:** Tampered downloads removed; clean version released - **Financial impact:** No total incident cost established in the reviewed evidence ## What happened [OVHcloud](https://www.ovhcloud.com/) said a compromised developer GitHub account replaced CLI binaries for versions 0.11.0–0.15.0 on October 19, 2026. [1](#source-1) ## Impact The affected download window was 14:47–16:21 UTC+2. The malware collected cloud credentials, SSH keys and developer-assistant data. Approximately 250 downloads were recorded, not 250 confirmed victims. OVHcloud said source code and its build chain were unaffected. [1](#source-1) ## Timeline ### October 19, 2026 — Malicious releases removed OVHcloud removed the binaries and released clean version 0.16.0. [1](#source-1) ### October 20, 2026 — Technical advisory published The [advisory](https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw) documented the compromise. [1](#source-1) ### October 21, 2026 — Briefing updated This briefing was last reviewed and updated on October 21, 2026. ## Threat Group & Attack Vector OVHcloud traced the account compromise to a malicious extension installed on a personal computer in October 2025. It said stolen keys enabled the release replacement. [1](#source-1) ### Actors - The advisory links an earlier extension wallet to Glassworm; the October operator remains unconfirmed. [1](#source-1) ### TTPs - [T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/): replacement of distributed binaries. [1](#source-1) ## Response OVHcloud suspended the account and enabled immutable releases. Users who ran affected downloads were told to replace secrets, remove the binary and upgrade. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### ovhcloud-cli security incident — October 19, 2026 official · OVHcloud · Oct 20, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: Malicious releases removed and clean version published 2. **Disclosed At · 100% confidence · current** OVHcloud CLI release compromise: 2026-10-19 3. **Used Attack Technique · 100% confidence · current** OVHcloud CLI release compromise: https://attack.mitre.org/techniques/T1195/002/ 4. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: The malicious CLI binaries collected local secrets and files for exfiltration, including cloud credentials, SSH keys and developer-assistant data. 5. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: Technical advisory published 6. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: Users who ran a copy obtained during the affected window were told to replace relevant secrets, remove the binary and install version 0.16.0. 7. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud reported approximately 250 downloads during the malicious-release window; this is not a count of compromised users or machines. 8. **Occurred At · 100% confidence · current** Technical advisory published: 2026-10-20 9. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud removed the malicious assets, suspended the account, enabled immutable releases and published clean version 0.16.0 with a signed tag. 10. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: The advisory associated a wallet from the earlier extension with Glassworm, but this technical association does not independently establish the operator behind the October release replacement. 11. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud said source code, its build chain and other repositories were unaffected; previously downloaded copies were outside this replacement window. 12. **Occurred At · 100% confidence · current** Malicious releases removed and clean version published: 2026-10-19 13. **Occurred At · 100% confidence · current** OVHcloud CLI release compromise: 2026-10-19 14. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud traced the developer account compromise to a malicious extension installed on a personal MacBook in October 2025 and said stolen keys, rather than that computer, were used to replace the CLI binaries. 15. **Resulted In · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud said a compromised developer GitHub account replaced release binaries for ovhcloud-cli versions 0.11.0 through 0.15.0 with malware on October 19 between 14:47 and 16:21 UTC+2. 16. **Affected Organization · 100% confidence · current** OVHcloud CLI release compromise: OVHcloud