OVHcloud CLI Supply-Chain Attack Replaces Five Releases with Malware

Hackers took over a contributor’s GitHub account and replaced real OVHcloud downloads with harmful software. The tool is the command-line interface (CLI), a text-based program that helps people manage cloud services. The malware aimed to steal sensitive information from infected computers.

The attack hit five releases of the cloud provider’s official tool. The bad files stayed online for up to 94 minutes on October 19, 2026. Reports indicate the attackers swapped the files between 12:47 and 14:21 UTC. The hit versions ran from v0.11.0 to v0.15.0. Some users could have received the bad files. These users downloaded or updated the tool during that window through weak installation methods.

This incident shows the danger of software supply chain attacks. In these attacks, criminals break into a trusted download source. They do not chase each victim one by one.

Fake Files Target Windows, Mac, and Linux Users

The attackers replaced download archives for three systems: macOS, Linux, and Windows. These archives hold the ready-to-run program files that people open after downloading. The list included macOS builds for Intel and Apple Silicon chips. It also covered Linux builds for x86-64 and ARM64 systems, plus the Windows x86-64 build.

The attackers also changed the checksum file for the v0.15.0 release. A checksum works like a seal on a package. It helps users confirm that a file has not changed. The code inside it is called a hash, and it acts like a fingerprint for the file. After the swap, the published values matched the bad files instead of the real ones. That change removed a warning sign for most users. Only a saved copy of the original hash could reveal the trick.

A customer’s automated build system spotted the problem first. This kind of system, known as continuous integration (CI), builds and tests software without human help. According to the investigation posted on the project’s GitHub issue page, a SHA-256 checksum test failed. The customer had saved the expected value for the Linux ARM64 archive. That saved value triggered an alert the moment the file changed.

Checks on the suspicious file showed more oddities. The file came from a later development commit, not from the original v0.15.0 release. Its build details also listed unsaved changes and settings that did not fit the normal release process.

The attackers reportedly uploaded the files through the hijacked contributor account. Investigators have not shared how the account was taken over. OVHcloud said its source code, release tags, and build pipeline stayed safe.

Account access and the protection of proprietary information are also central concerns in other technology disputes, including Apple’s trade secrets lawsuit against OpenAI and former employees.

Some Install Routes Stayed Safe as OVHcloud Locks Down Releases

Not every user faced the danger. Several install methods already had strong checks in place. Reports say the Homebrew route avoided the bad files because its package definition already held the original hashes. That package file compared every archive against the original codes, so a swapped file would not match. Installing through Go’s package process also kept users safe. So did building from source and using the existing Docker image.

OVHcloud removed the malicious files and published version v0.16.0 as an immutable release. GitHub’s immutable release feature stops anyone from changing release files and tags after publication. That protects future downloads from the same kind of tampering. Attackers can no longer slip new files into an old release.

The company also turned on release immutability for its upcoming releases. You can view the clean version on the official releases page. That page also lists the version history and release details for the tool. Users can compare it with the five affected versions. However, the new version cannot protect secrets that the malware may have already copied. Affected users must take extra steps.

Users Told to Change Secrets While Key Questions Remain

Founder Octave Klaba advised affected users to change their secrets. Anyone who installed or ran a bad build should treat every credential on that machine as exposed. That includes API keys, tokens, configuration secrets, and other private data.

Security researchers suggest changing these credentials from a separate, trusted computer. Users should then delete the suspicious file and install the clean v0.16.0 release. OVHcloud named this version the safe one. Next, they should check their downloads with GitHub’s release verification tools.

Some researchers also asked whether the GlassWorm malware campaign played a part. That campaign has hit software development communities before. Researchers who studied the account activity said the same account showed suspicious behavior in earlier incidents. They have not proven that the same group carried out the October attack.

The malicious file disappeared before researchers saved a copy for public study. OVHcloud has not said how many users downloaded the bad files. It has also not said what information the malware collected. The company has not revealed where the stolen data went.

OVHcloud promised a more detailed report after its investigation. For now, the attack itself is confirmed. The stolen data, the number of victims, and the attacker’s identity remain unknown.