On October 19, an attacker used a hijacked GitHub account to replace the download files on five existing releases of OVHcloud’s open-source command-line tool, according to OVHcloud’s CEO, Octave Klaba, as relayed by BleepingComputer and The Hacker News. The swapped builds were made to steal secrets stored on the disk of any machine that ran them. OVHcloud says the company’s own CI/CD pipelines were not touched; the malicious files were built locally and uploaded straight onto the releases.
The swapped files were live for about 94 minutes. The Hacker News gives the window as 12:47 to 14:21 UTC; BleepingComputer’s times (14:47 to 16:21) are two hours later, which matches French local time. A customer reported the problem, and OVHcloud deleted the archives and published a clean v0.16.0 as an immutable release. Klaba said the root cause was that GitHub’s release-immutability setting had not been turned on, so an account with enough permissions could edit existing releases; OVHcloud has now enabled it. The community threat-intelligence platform OpenSourceMalware links the activity to GlassWorm, a campaign that has previously hit VS Code, OpenVSX, GitHub and npm. It notes the compromised account had been under the attacker’s control for more than half a year. Its report did not analyse the payload, and OVHcloud has promised a postmortem.
How to check if you’re affected
Affected versions are OVHcloud CLI v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. OVHcloud lists v0.10.0 and v0.16.0 as clean. The Hacker News says only the macOS, Linux (x86_64 and arm64) and Windows x86_64 archives were swapped.
- You may have received a swapped file if, during the window on Monday, you ran the official
install.shscript, downloaded an archive from one of those five release pages, ran a CI job that fetches the archive without a pinned hash, or used the CLI’s ownupgradecommand from v0.12.0 to v0.14.0 on macOS or Linux. - According to The Hacker News, Homebrew installs were not affected because the cask pins each archive’s SHA-256 and would have refused the swapped file.
go install, source builds and the Docker image (last pushed September 21) were also not affected. - Someone who reported the problem on GitHub pulled build information from the swapped Linux arm64 binary with
go version -m, which reads the file without running it. The swapped build showed a version string ofv0.15.1-0.20261013083505-5ead8ef9b43d+dirty, commit5ead8ef(the genuine v0.15.0 tag points to760fd72), and a-ldflags="-s -w"line. The Hacker News notes that a+dirtymarker alone does not mean a build is malicious, since OVHcloud’s genuine v0.16.0 also shows it. - If you ran a swapped build, or cannot tell, OVHcloud’s advice is to change every secret stored on that disk. OpenSourceMalware adds that you should do it from a different machine. That covers the OVHcloud API credentials the CLI keeps in
~/.ovh.confand everything else readable from the machine. Then remove the binary and install v0.16.0; updating alone does not revoke credentials that were already copied.
Sources
- OpenSourceMalware: GlassWorm hacks OVH Cloud’s CLI tool
- ovh/ovhcloud-cli on GitHub: issue #300 reporting the swapped build
- ovh/ovhcloud-cli: v0.16.0 release
- GitHub Docs: immutable releases
- BleepingComputer: OVHcloud CLI releases backdoored on GitHub to steal developer secrets
- The Hacker News: Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware