Ethical Hacking News
Hackers hijacked five OVHcloud CLI releases to distribute secret-stealing malware, exploiting a vulnerability in the company's command-line tool. The attack highlights the importance of keeping software up to date and being vigilant about security threats. OVHcloud has promised a detailed postmortem and is advising its users to rotate any sensitive data exposed during the attack. The incident serves as a reminder of the need for increased security awareness and vigilance in the open-source community.
The OVHcloud CLI was compromised by hackers who used it to distribute secret-stealing malware. The attack began when a contributor's GitHub account was hijacked, allowing the hackers to replace the download archives on the five existing releases of the CLI. The compromised releases were live on GitHub for up to 94 minutes, exposing anyone who installed or updated the CLI during that time window to the malicious code. The attack highlights the importance of keeping software up to date and being vigilant about security threats. OVHcloud deleted the swapped archives and published a clean v0.16.0 release, which is an immutable release. The attack was discovered by a customer who identified the malicious code by looking for certain markers in the release files. The attack emphasizes the need for increased vigilance and security awareness in the open-source community.
In a shocking turn of events, five existing releases of OVHcloud's command-line tool were compromised by hackers, who then used them to distribute secret-stealing malware. The attack, which was discovered on October 19, 2026, highlights the vulnerability of the open-source community to malicious manipulation and the need for increased vigilance in the face of increasingly sophisticated cyber threats.
The attack began when a contributor's GitHub account was hijacked, allowing the hackers to replace the download archives on the five existing releases of OVHcloud's command-line tool. The new files were a build designed to steal secrets stored on the disk of any machine that runs it, according to OVHcloud. The attack was successful because the hackers were able to bypass the usual security checks that are in place to prevent such malicious activity.
The compromised releases were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC, and were only accessible to people who installed or updated the OVHcloud CLI during that window, via a path that checks for no hash, on macOS, Linux x86_64 or arm64, or Windows x86_64. This means that anyone who installed or updated the CLI during that time window was potentially exposed to the malicious code.
OVHcloud deleted the swapped archives and published a clean v0.16.0 that evening, which is an immutable release, whose files GitHub will not let anyone change. The source code, the release tag, and the company's build pipeline were not touched, as the bad build was a plain go build of a later commit, uploaded straight onto releases published between April and September.
The attack had a significant impact on the users of the OVHcloud CLI, with anyone who installed or updated the CLI during the compromised window potentially exposed to the malicious code. The attack also highlights the importance of keeping software up to date and being vigilant about security threats.
In a statement, OVHcloud founder Octave Klaba wrote that anyone affected should change every secret stored on the disk. The CLI keeps OVHcloud API credentials in ~/.ovh.conf and reads them from environment variables, according to its documentation.
The attack was discovered by a customer who pulled the build information out of the new v0.15.0 Linux arm64 binary with go version -m, which reads the file without running it, and posted it in a GitHub issue. The customer was able to identify the malicious code by looking for certain markers, such as a pseudo-version and a commit hash that did not match the expected value.
The attack was carried out by an attacker who used a contributor's GitHub account to replace the download archives on the five existing releases of OVHcloud's command-line tool. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it.
The attackers were able to exploit the vulnerability because the contributor's GitHub account had been compromised, allowing them to upload the malicious code to the releases. The attack highlights the importance of keeping software up to date and being vigilant about security threats.
In a second post, Klaba wrote that the problem stemmed from the immutability option not being activated, so a user with the right permissions could modify existing releases directly on GitHub without any checks by the company's CI/CD pipeline. The option has now been enabled, and the pipelines themselves were not affected.
The five old releases now offer only the four archives the attacker did not touch. The uploads came through the account of a contributor whose merged work is in OVHcloud's documentation repository and who is not a public member of the organization, according to OpenSourceMalware.
The attack was discovered by a customer who pulled the build information out of the new v0.15.0 Linux arm64 binary with go version -m, which reads the file without running it, and posted it in a GitHub issue. The customer was able to identify the malicious code by looking for certain markers, such as a pseudo-version and a commit hash that did not match the expected value.
The attackers were able to exploit the vulnerability because the contributor's GitHub account had been compromised, allowing them to upload the malicious code to the releases. The attack highlights the importance of keeping software up to date and being vigilant about security threats.
In the wake of the attack, OVHcloud has promised a detailed postmortem in the coming days. The company has also offered advice to its users, recommending that they treat every secret readable from that machine as exposed and rotate it. OpenSourceMalware has also added that the rotation should be done from a different machine.
The attack is a reminder that the open-source community is not immune to cyber threats. It highlights the importance of vigilance and security awareness, particularly when it comes to software updates and releases.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Dark-Side-of-Open-Source-A-Tale-of-Malicious-Manipulation-in-the-World-of-OVHcloud-ehn.shtml
https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html
https://cybersecuritynews.com/ovhcloud-supply-chain-attack/
Published: Tue Oct 20 17:02:08 2026 by llama3.2 3B Q4_K_M
