{
  "type": "bundle",
  "id": "bundle--4f0caecf-1991-557a-8b0c-cda1f749c454",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--25746336-a4d4-50a1-82c0-22005d7910c4",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "org:6cc35c55-6c81-4506-9a75-857d70ff8d0f",
      "name": "OVHcloud",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--010e72c0-97f3-56dc-80ee-477e84aa51c1",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "brh:2adcff39-f511-401e-9de9-c4c06b2e8420",
      "name": "OVHcloud CLI release compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ba8061a4-c7cf-53fe-84bb-eeaf866a2e4d",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "inc:f34f6f99-1536-47ba-b3f4-904db24d9675",
      "name": "OVHcloud CLI release compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0f2ff013-b16d-5ac2-8a6f-f0907e5b3644",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:161bded3-87eb-44c2-a93c-81e4703ae53c",
      "relationship_type": "resulted-in",
      "source_ref": "incident--ba8061a4-c7cf-53fe-84bb-eeaf866a2e4d",
      "target_ref": "x-ally-event--12729216-13c2-5d96-8583-b911b9ddbc0f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:be5cb73e-74e0-4657-bba4-53ae019fb687",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1634fe7c-2e6e-5513-8d66-f97d3983df8a",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:51d9a271-253e-4e26-b6e4-ce3e630b4983",
      "relationship_type": "resulted-in",
      "source_ref": "incident--ba8061a4-c7cf-53fe-84bb-eeaf866a2e4d",
      "target_ref": "x-ally-event--8aecaa45-1cbb-58b5-8e7c-be5cbb98f0e7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:a72fbf81-81fb-4b0e-b665-c22175d6c998",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6eb1e66b-0951-54a2-87d1-5fc1a8ce3896",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:f7623bd9-ff91-45ea-a1f2-3d9e14913378",
      "relationship_type": "affected-organization",
      "source_ref": "incident--ba8061a4-c7cf-53fe-84bb-eeaf866a2e4d",
      "target_ref": "identity--25746336-a4d4-50a1-82c0-22005d7910c4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:b5588888-ba3d-47da-aa5c-b46531c31eda",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2f0d6e57-9dc1-5b01-8a95-15828f20dcaa",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:cb3921c6-e736-4a00-b1a4-b72dc22a2ec6",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:7b1fa5f6-892d-4671-9156-e6219238fce9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OVHcloud traced the developer account compromise to a malicious extension installed on a personal MacBook in October 2025 and said stolen keys, rather than that computer, were used to replace the CLI binaries."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--39600402-afaa-574e-8229-9ed39bd26887",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:19a831ff-8ff1-4011-9830-fb461174b0b7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:f1400110-d2e0-4069-925f-f1a08e93096f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-19"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--49a9cfb6-a488-5e34-8f15-8ba245886f16",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:ef628215-c6bd-48da-81dd-e92db6f516f3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:ac5b9f8b-0b08-4eff-9c37-bfbbc856c63b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OVHcloud said a compromised developer GitHub account replaced release binaries for ovhcloud-cli versions 0.11.0 through 0.15.0 with malware on October 19 between 14:47 and 16:21 UTC+2."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6db19b9c-a5bd-5c22-8628-7a4a78d09bfb",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:8e60ca4a-a3eb-4b9f-aa57-debc21c5d27a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:3decc4fb-725f-4e51-a8a1-d6c906c21d1c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-20"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--71e714f0-c9ce-57a9-800a-55cf87f146d2",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:9b36f211-e040-459a-91f7-600253b21ad2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:e0025c33-5a5c-4b6e-9ec3-0f15f8afafba",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The advisory associated a wallet from the earlier extension with Glassworm, but this technical association does not independently establish the operator behind the October release replacement."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--870e5bbf-00af-557c-8803-8807e106b6bf",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:a720eb10-d921-4591-8977-88141405d139",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:768a5d54-9a62-4d1a-9334-a0f24a04c5c3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-19"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a2efa368-db23-509b-8351-65a58c657ec3",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:71ed75c3-783d-46f4-99ad-f71094123424",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:a17080df-d040-4e97-b7bf-e505252dc8ea",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OVHcloud reported approximately 250 downloads during the malicious-release window; this is not a count of compromised users or machines."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a5e17b1c-9f69-5cd0-8d9f-9aecada59630",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:925af55a-74a1-468c-a1be-22f904b0ea3f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:21bb56bb-076e-461a-8a3e-7cd9bb1db004",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OVHcloud removed the malicious assets, suspended the account, enabled immutable releases and published clean version 0.16.0 with a signed tag."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b1c2959e-6da1-530c-8356-c2594f3fad30",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:284f1f30-3e28-4705-9f80-bd9a8dfcad5e",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1195/002/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--be78fc8b-d2be-5521-81a4-0dbc890fc392",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:5f75464b-79df-41d0-a76c-3b52ebc95810",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:286a2929-b724-4012-9e83-d03338ef21ed",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Users who ran a copy obtained during the affected window were told to replace relevant secrets, remove the binary and install version 0.16.0."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c877a171-f9f8-5596-806d-ddec453e077b",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:bdc497d6-7aa5-4792-9371-19d2de3310ed",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:52f678be-2d47-454a-bf4f-269d291e8ad0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-19"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--dc19586e-86b3-5a61-83eb-e0198fba22e5",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:3f3aa6c8-2853-4269-a92d-fc1da7e1d7d8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:8bcc67c4-5ad3-441f-82cf-df3a1284d9f9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The malicious CLI binaries collected local secrets and files for exfiltration, including cloud credentials, SSH keys and developer-assistant data."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--fbdedad8-b08b-562c-8ace-509c7d243d86",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "clm:a6800857-44ae-4c22-b7cb-c039b2bb289c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OVHcloud",
          "url": "https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw",
          "external_id": "cit:b7e55aae-2747-4132-83d2-9da7d2976d3d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fdaf251351271d22c0331a87b1aeab67d76ec360cd864ec84cb066dd0a07930f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OVHcloud said source code, its build chain and other repositories were unaffected; previously downloaded copies were outside this replacement window."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--12729216-13c2-5d96-8583-b911b9ddbc0f",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "evt:1fb5e3ee-632b-4b99-b526-bed28d3a4cb2",
      "name": "Malicious releases removed and clean version published"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--8aecaa45-1cbb-58b5-8e7c-be5cbb98f0e7",
      "created": "2026-10-21T14:54:33.960571+00:00",
      "modified": "2026-10-21T14:54:33.960571+00:00",
      "x_ally_original_id": "evt:d7682646-9bca-4e46-8dcd-27e0b58d2960",
      "name": "Technical advisory published"
    }
  ]
}