OVHcloud CLI · Exploitation confirmed

OVHcloud CLI GitHub releases delivered credential stealer; v0.16.0 fixes it

Oct 18, 2026 · 1 min read

An attacker replaced binaries of OVHcloud CLI releases v0.11.0 through v0.15.0 on GitHub with a credential stealer, between 12:47 and 14:21 UTC on October 19, 2026, with about 250 downloads. OVHcloud confirmed the case in advisory GHSA-862f-55f5-vmvw and shipped v0.16.0, immutable and attested. Anyone who downloaded in that window must treat the host as compromised, rotate all secrets, and reinstall v0.16.0.

By HIFY Radar newsroom Updated 10/26/2026 01:20 PM Get this every day →← Back to the feed 2 sources

HighSupply chainExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An attacker swapped files on five official OVHcloud CLI releases on GitHub with a credential-stealing program. The window lasted 94 minutes on October 19, 2026, with about 250 downloads. OVHcloud confirmed the incident and shipped the clean v0.16.0.

Why it matters

Machines that ran a binary downloaded in that window must be treated as compromised: the code targeted cloud credentials (AWS, GCP, Azure), SSH keys, Docker, Kubernetes, Terraform and NPM configs, and AI agent credential stores such as Claude and Cody. Homebrew, go install, Docker, and source-build installs were not affected.

What to do

Treat every machine that ran a binary downloaded between 12:47 and 14:21 UTC on Oct 19, 2026 as compromised, and rotate every secret it could read from a different machine. Reinstall from v0.16.0, verify the asset with gh release verify-asset, and check for /tmp/envchecker-* directories.

For the technical team

Affected: OVHcloud CLI (releases no GitHub) · Release assets of ovh/ovhcloud-cli v0.11.0 through v0.15.0 downloaded between 12:47 and 14:21 UTC on Oct 19, 2026. Homebrew, go install, source builds, and the Docker image unaffected.
Exploitation: Real-world exploitation confirmed: swaps live for 94 minutes, around 250 downloads. Spotted by a customer whose CI pins the SHA-256 of the Linux arm64 tarball (issue #300). StepSecurity rebuilt the attacker's build, recovered the GlassWorm loader from an orphaned commit, and detonated the full chain in an isolated environment.
Fix: v0.16.0, published 17:16 UTC, immutable, signed tag, release attestation. Verify: gh release verify-asset v0.16.0 ovhcloud-cli_Linux_x86_64.tar.gz. Updating revokes nothing: rotate every secret reachable from the affected machine.
Vector: GitHub supply chain: the contributor account HassenBF, holding write access, replaced assets and checksums.txt on old releases because GitHub release immutability was not enabled. Binaries were built locally and uploaded straight onto existing releases; no CI ran, no tag moved, the source repository was never touched. Initial access traces to October 2025 via a malicious VS Code extension (color-picker-universal 2.8.91) on a personal MacBook, with a persistent NodeJS service registered via plist, per OVHcloud's postmortem.
More details: One-command tell: 'ovhcloud version' prints version undefined alongside the attacker's build commit (2026-10-13T08:35:05Z); build lacks GoReleaser's version ldflag and uses -ldflags=-s -w. install.sh performs no checksum verification, never reads checksums.txt, and never exposed arm64 Linux. Swap order: v0.15.0 at 12:47, its checksums.txt at 12:57, then v0.14.0 and v0.13.0 through 13:12. Stealer targets: AI-agent credential stores (Claude, Hermes, Continue, Cody, OpenCode), cloud CLIs (AWS, GCP, Azure, doctl), Docker and Kubernetes configs, Terraform, NPM, SSH keys.netrc.gitconfig. Attacker rehearsal: force-pushes with hidden preinstall.js on personal repos on Mar 5-6, 2026, ForceMemo pattern with a Solana dead drop. Uploads used stolen keys, not the developer's machine; OVHcloud does not believe the corporate laptop was compromised. Advisory rated critical.