OVHcloud's CLI releases were backdoored on GitHub. The malware hunted secrets on disk.
By Lior AharonovFounder, 7IT Solutions ·
Attackers hijacked a developer's GitHub account and tampered with OVHcloud CLI releases v0.11.0 to v0.15.0. The compromised release appeared at 14:47 on 19 October and was blocked at 16:21 after a customer report. OVHcloud says v0.10.0 and v0.16.0 are clean, and source builds and Docker images were not affected.
A cloud CLI lives on the laptop that holds your tokens and keys. One download of the wrong binary and those secrets are someone else's. The attacker uploaded locally built packages, so the release pipeline never saw them.
If anyone ran OVHcloud CLI v0.11.0 to v0.15.0, treat every secret on that machine as compromised: clean it up and revoke the keys. Then turn on GitHub's release immutability for your own repositories.
A release you did not build yourself is a stranger's binary wearing your logo. Pin it, hash it, and lock your releases.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.