OVHcloud CLI Releases v0.11.0 to v0.15.0 Were Swapped for Secret-Stealing Builds for 94 Minutes

Anyone who ran the official OVHcloud CLI install script, or downloaded a release archive from GitHub, between 12:47 and 14:21 UTC on Monday, October 19 may have run a build designed to steal secrets from disk. An attacker used a hijacked contributor account to overwrite the download archives on five already-published releases of ovh/ovhcloud-cli, v0.11.0 through v0.15.0, according to The Hacker News.

The fix for affected machines is to rotate every secret on them, from a different machine, and install v0.16.0.

What was replaced, and what was not

Six files per release were swapped: the macOS and Linux archives for x86_64 and arm64, the Windows x86_64 archive, and checksums.txt. OpenSourceMalware's analysis says checksums.txt was updated last so the hashes matched the new files. The Linux i386, Windows i386, Windows arm64 and WebAssembly builds were not replaced. The source code, tags and build pipeline were untouched, and the release workflow never ran during the window.

The swapped binaries were plain go build outputs of an untagged commit, 5ead8ef, merged to main on October 13, rather than the v0.15.0 tag commit 760fd72. That difference is how the swap was found.

Timeline on October 19 (UTC)

Time	Event
12:47	First archives replaced
13:50	A customer posts GitHub issue #300 after a pinned SHA-256 fails in CI
14:21	OVHcloud deletes the replaced archives
Later that day	v0.16.0 published with a signed tag and immutable release

The reporter, using the handle alink-tothepast, wrote that the new Linux arm64 binary was a local build of a later commit with uncommitted changes and asked, "Could you confirm whether this was intentional?" OVHcloud's rbeuque74 replied that the binaries were deleted, shipped v0.16.0, promised a post-mortem, and published advisory GHSA-862f-55f5-vmvw on October 20.

Who was exposed

The Hacker News lists the exposure paths: the install script (curl -fsSL .../install.sh | sh), which has never checked a hash; a manual download from any of the five release pages; CI jobs fetching an archive without a pinned hash; and the CLI's upgrade command run from v0.12.0, v0.13.0 or v0.14.0 on macOS or Linux.

Not exposed: Homebrew installs, because the tap's cask pinned the original SHA-256 hashes; go install or source builds, since the v0.15.0 tag still points to 760fd72; the Docker image ovhcom/ovhcloud-cli, last pushed September 21; and anyone who installed before 12:47 UTC and did not update in the window.

How the account was taken over

Founder Octave Klaba attributed the root cause to release immutability not being enabled, so anyone with write access could alter existing releases, per The Hacker News. How the contributor's credentials were stolen has not been disclosed.

OpenSourceMalware ties the account, HassenBF, to GlassWorm. Four of its personal repositories were force-pushed on March 5 and 6 with a loader that fetches its next stage from a Solana wallet's transaction memo. The researchers call the link "our inference", resting on the shared account, and say they cannot tell whether one actor held the account throughout. No copy of the October binary has been analyzed in public, so what it collects and where it sends it is unknown. OVHcloud has not said how many copies were downloaded.

Checks and fixes

The swapped v0.15.0 Linux arm64 build reports the module string v0.15.1-0.20261013083505-5ead8ef9b43d+dirty under go version -m, which reads build info without running the file. Its archive SHA-256 is 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb; the original is 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0.

Verify v0.16.0 with gh release verify-asset v0.16.0 FILE, and pin hashes in install scripts. For similar fast-moving package compromises, see our reports on the LiteLLM 1.107.0 release and the OpenCode and Warp backend breaches. The next item to watch is OVHcloud's promised post-mortem.