Attackers swapped download files for five versions of OVHcloud's command-line tool for 94 minutes. Anyone who installed it in that window may need to change passwords.
On Monday, October 19, an attacker used a hijacked contributor account on GitHub to replace the download files for five releases of OVHcloud's command-line tool. The replacement was a build designed to steal secrets stored on the disk of any machine that runs it, according to the cloud provider. OVHcloud is a hosting company, and the tool lets staff manage their accounts from a terminal.
The swapped files were live from 12:47 to 14:21 UTC, up to 94 minutes. They replaced releases v0.11.0 through v0.15.0, which were published between April 14 and September 16. The attacker also replaced the checksums file, so the published fingerprints matched the bad files. OVHcloud deleted the swapped archives and later published a clean v0.16.0.
Only people who installed or updated the tool during that window were exposed. That means macOS, Linux x86_64 or arm64, or Windows x86_64, using an install method that does not check the file's fingerprint. Linux i386, Windows i386, Windows arm64 and WebAssembly builds were left alone. A copy installed before 12:47 UTC on Monday and not updated since is the original. Version v0.10.0 is listed as clean.
The tool keeps OVHcloud API credentials in a file called ~/.ovh.conf and reads them from environment variables. OVHcloud founder Octave Klaba said anyone affected should change every secret stored on the disk, not only those files. OVHcloud has not said which files the bad build reads, where it sends them, or how many copies were downloaded. No swapped archive has been analyzed in public.
A customer's automated job checks the fingerprint of the Linux arm64 download and started failing. With no private way to report a problem, the customer filed a public GitHub issue. OVHcloud removed the swapped files about half an hour after that. Klaba said the cause was a GitHub setting, release immutability, that was not turned on. It locks a release's files so no one can change them. It is now enabled. The source code and build pipeline were not affected.
OVHcloud has promised a detailed postmortem in the coming days. It has not said how the contributor's credentials were taken. Researchers at OpenSourceMalware link the account to GlassWorm, a malware campaign, but call that their inference. Nothing from the October build has been tied to it. The steps in the alert box above cover what a business should do now.
If anyone installed or updated the OVHcloud command-line tool on Monday, October 19, treat the secrets on that machine as exposed and replace them.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
