# OVHcloud CLI Compromised in GitHub Supply Chain Attack

> Malicious software designed to steal user secrets was distributed through OVHcloud's GitHub repository for 94 minutes after a developer's account was hijacked.

By PrimaryBrief newsroom · Published 2026-10-23T11:08:34.262984Z
Canonical: https://primarybrief.com/article/ovhcloud-cli-compromised-in-github-supply-chain-attack-fb4ebdda

On October 19, 2026, an attacker compromised a developer's GitHub account and distributed malicious command-line interface (CLI) binaries through OVHcloud’s official repository [3][7]. The compromised files were available for 94 minutes and downloaded approximately 250 times before OVHcloud blocked them [1][5].

This incident reveals vulnerabilities in software supply chain security. Users who downloaded affected versions of the OVHcloud CLI face a risk of having sensitive data stolen, requiring immediate action to protect their credentials [1][3].

## What the records show

The attacker bypassed OVHcloud’s continuous integration and continuous delivery (CI/CD) pipelines by using the hijacked developer’s GitHub account to upload locally built malicious packages directly to existing releases [2][8]. The core vulnerability was that the GitHub repository lacked the “release immutability” option. This setting allowed existing releases to be modified without additional checks [2][5]. The malicious binary was designed to steal secrets from users’ systems, including API keys, cloud credentials, and SSH keys [1][3]. OVHcloud CEO Octave Klaba acknowledged the binary was “poor quality” but confirmed it could effectively steal secrets [3][5]. The compromised versions of the CLI included v0.11.0 through v0.15.0. Version v0.10.0 and the newly released v0.16.0 were not affected [4][6]. The attacker did not compromise the developer's OVHcloud laptop, but used stolen keys [9].

## The timeline

Malicious files were uploaded to the OVHcloud CLI GitHub repository at 12:47 UTC on October 19, 2026 [7]. These files replaced downloadable archives across five existing releases for macOS, Linux, and Windows platforms [7]. A customer publicly reported the issue on GitHub at 13:50 UTC after their automated hash check failed in a continuous integration pipeline [7][10]. OVHcloud detected and blocked the malicious files by 14:21 UTC, making them available for approximately 94 minutes [1][7]. A new, clean, and immutable release, v0.16.0, was published at 17:16 UTC under OVHcloud’s `ovh-cds` account with a signed tag [7]. OVHcloud released a post-mortem detailing the incident on October 20, 2026 [1].

## What changed and for whom

OVHcloud has since enabled the “release immutability” option across all its repositories to prevent similar incidents [2][5]. For users who downloaded the affected CLI versions, OVHcloud strongly advised updating or deleting the software [3][4]. The company also recommended “change all the secrets stored on your disk,” including rotating API keys, cloud credentials, and SSH keys, preferably from a different, clean machine [1][3]. OVHcloud further advised pinning checksums for third-party binaries and building Go tools from the module proxy as preventative measures [1]. The new v0.16.0 release includes release attestation to ensure its integrity [7][13].

## What OVHcloud has said publicly

OVHcloud CEO Octave Klaba confirmed the incident on X on October 19, 2026 [3][5]. He stated that the hacker used a developer’s GitHub account to add a binary designed to retrieve secrets from the disk [3][5]. Klaba urged users who downloaded affected CLI versions to update or delete them immediately and to “change all the secrets stored on your disk” [3][4]. In a follow-up post, Klaba noted that the company’s CI/CD pipelines were not impacted. He added that the issue stemmed from the lack of the release immutability option on GitHub, which has now been enabled [2][9].

## What we could not confirm

It is unclear if the attacker associated with the OVHcloud CLI compromise in October 2026 is the same actor responsible for a separate compromise of the developer’s GitHub account in March 2026, which researchers have linked to the GlassWorm threat actor [6][8]. OVHcloud has not publicly mentioned GlassWorm in its statements regarding this incident [6]. While the attacker used stolen keys, it is not confirmed how the developer’s GitHub account credentials were initially compromised [9].

## Evidence cited
1. OVHcloud CLI Backdoored: What You Need To Know (securityonline.info) — https://securityonline.info/news/ovhcloud-cli-backdoored/
2. OVHcloud CLI compromise: What happened and how to respond (helpnetsecurity.com) — https://www.helpnetsecurity.com/2026/10/21/ovhcloud-cli-compromise/
3. OVHcloud CLI Compromise: Malicious Binary Distributed via GitHub (gbhackers.com) — https://gbhackers.com/ovhcloud-cli-compromise/
4. Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware (cybersecuritynews.com) — https://cybersecuritynews.com/hackers-hijack-ovhcloud-github-releases/
5. OVHcloud GitHub Repo Compromised by GlassWorm Threat Actors (darkreading.com) — https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-repo-compromised-glassworm-threat-actors
6. OVHcloud CLI Tool Backdoored via Compromised GitHub Account (securityweek.com) — https://www.securityweek.com/ovhcloud-cli-tool-backdoored-via-compromised-github-account/
7. Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (thehackernews.com) — https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
8. OVHcloud CLI releases backdoored on GitHub to steal developer secrets (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/
9. OVHcloud CLI GitHub supply chain attack: What you need to know (thestack.technology) — https://thestack.technology/ovhcloud-cli-github-supply-chain-attack/
10. OVHcloud CLI backdoored: what happened and what to do - Pasquale Pillitteri (pasqualepillitteri.it) — https://www.pasqualepillitteri.it/2026/10/20/ovhcloud-cli-backdoored/
11. OVHcloud CLI GitHub Releases Hijacked for Secret-Stealing Malware (substack.com) — https://substack.com/profile/13813936-rod-s-blog/note/18318041
12. OVHcloud warns compromised CLI versions could steal local secrets : r/SysAdminBlogs (reddit.com) — https://www.reddit.com/r/SysAdminBlogs/comments/162s3k6/ovhcloud_warns_compromised_cli_versions_could/
13. OVHcloud CLI compromised in supply chain attack (scworld.com) — https://www.scworld.com/news/ovhcloud-cli-compromised-in-supply-chain-attack/
14. OVHcloud CLI downloads carried a secret stealer for up to 94 minutes (webhosting.today) — https://webhosting.today/news/ovhcloud-cli-downloads-carried-a-secret-stealer-for-up-to-94-minutes
15. OVHcloud warns compromised CLI versions could steal local secrets : r/blueteamsec (reddit.com) — https://www.reddit.com/r/blueteamsec/comments/162s3k6/ovhcloud_warns_compromised_cli_versions_could/
16. OVHcloud CLI compromised - gridinsoft.com (gridinsoft.com) — https://gridinsoft.com/blogs/ovhcloud-cli-compromised/
17. OVHcloud CLI GitHub Releases Backdoored on GitHub to Steal Developer Secrets : r/sysadmin (reddit.com) — https://reddit.com/r/sysadmin/comments/1cvp25h/ovhcloud_cli_github_releases_backdoored_on/
18. OVHcloud CLI Supply Chain Attack: What We Know (offseq.com) — https://offseq.com/blog/ovhcloud-cli-supply-chain-attack-what-we-know
19. RH-ISAC Report: Glassworm Malware Targets Developers Through npm, PyPI, OpenVSX, and GitHub (rhisac.org) — https://www.rhisac.org/news/rh-isac-report-glassworm-malware-targets-developers-through-npm-pypi-openvsx-and-github
20. OVHcloud CLI Downloads Carried a Secret Stealer for Up to 94 Minutes (webhosting.today) — https://www.webhosting.today/cloud/ovhcloud-cli-downloads-carried-a-secret-stealer-for-up-to-94-minutes/
21. OVHcloud CLI GitHub Releases Hijacked for Secret-Stealing Malware (substack.com) — https://substack.com/profile/138133342-rods-blog/note/p-142823631
22. OVHcloud CLI GitHub Releases Backdoored on GitHub to Steal Developer Secrets : r/netsec (reddit.com) — https://reddit.com/r/netsec/comments/1cvp25h/ovhcloud_cli_github_releases_backdoored_on/
23. secyour.pro (secyour.pro) — https://secyour.pro/
24. nameocean.net (nameocean.net) — https://nameocean.net/
25. secure.com (secure.com) — https://secure.com/
26. penligent.ai (penligent.ai) — https://penligent.ai/
27. reddit.com (reddit.com) — https://reddit.com/
28. cloudanix.com (cloudanix.com) — https://cloudanix.com/