French cloud provider OVHcloud says an attacker used a hijacked contributor account on GitHub to replace the downloadable files on five existing releases of its command-line tool with malicious builds designed to steal secrets stored on any machine that ran them. The swap, discovered and reversed on Monday, left tampered files live for roughly 94 minutes, from 12:47 to 14:21 UTC, according to details published by The Hacker News.
The attacker did not touch OVHcloud's source code, release tags or build pipeline. Instead, the intruder directly uploaded a plain rebuild of a later, unreviewed commit onto the download pages of versions v0.11.0 through v0.15.0, replacing the macOS, Linux and Windows x86_64 archives on most of those releases. Versions installed through Homebrew, via the standard Go package installer, built from source, or pulled as a Docker image were not affected -- only users who downloaded or updated through the raw GitHub release archive during the 94-minute window were exposed.
OVHcloud's command-line tool stores account API credentials in a local configuration file and reads them from environment variables, which the company says made it an effective target for a credential-stealing payload; it has not disclosed exactly which files the malicious build searched for or where stolen data would have been sent, and no copy of a tampered archive has been publicly analyzed. OVHcloud founder Octave Klaba said on social media that affected users should rotate every secret stored on the machine that ran the compromised build, warning that simply updating to a clean version does not revoke credentials that were already copied.
Klaba said the underlying cause was that OVHcloud had not enabled release immutability on the repository, meaning a user with the right permissions could modify files on an already-published release without triggering the pipeline's usual checks; that setting has now been turned on. The company published a clean v0.16.0 release as an immutable build the same evening and has promised a fuller postmortem in the coming days. Independent researchers at OpenSourceMalware have linked the compromised contributor account to the GlassWorm campaign, a prior wave of malicious open-source packages, though they describe the connection as an inference rather than a confirmed link, since no sample of the October payload has survived for analysis.
