OVHcloud CLI Tool Compromised in Malware Attack Targeting Secrets
French cloud provider OVHcloud has confirmed that attackers hijacked its open-source command-line interface (CLI) tool to distribute information-stealing malware. The breach occurred after a developer’s GitHub account was compromised, allowing the attacker to modify versions 0.11.0 through 0.15.0 of the OVHcloud CLI between 14:47 and 16:21 on October 19.
The CLI tool, used by administrators and developers to manage cloud services via terminal, was altered to exfiltrate secrets from infected systems. OVHcloud CEO Octave Klaba stated that while the malware was poorly constructed, it could still retrieve sensitive data from disks. The company has since released a clean version (0.16.0) and enabled GitHub’s release immutability feature to prevent future tampering.
Investigations by OpenSourceMalware linked the attack to GlassWorm, a threat actor active since late 2025, known for targeting software development ecosystems like VSCode, GitHub, and npm. The compromised GitHub account had been under attacker control for over six months, with evidence of scripted history rewrites and hidden malicious loaders. The malware affected macOS (Intel/ARM), Linux (x86_64/ARM64), and Windows x86-64, though source builds and Docker images remained untouched.
OVHcloud advises users who downloaded the compromised versions to revoke all secrets and perform a system cleanup. The incident highlights risks in open-source supply chains, particularly when CI/CD safeguards are bypassed.
OVHcloud TPRM report: https://www.rankiteo.com/company/ovhgroup
"id": "ovh1792499223",
"linkid": "ovhgroup",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users who downloaded '
'compromised CLI versions '
'(0.11.0-0.15.0)',
'industry': 'Technology/Cloud Computing',
'location': 'France',
'name': 'OVHcloud',
'type': 'Cloud Service Provider'}],
'attack_vector': 'Compromised Developer Account (GitHub)',
'customer_advisories': 'Public advisory to users who downloaded compromised '
'CLI versions',
'data_breach': {'data_exfiltration': 'Yes',
'sensitivity_of_data': 'High (Secrets could enable further '
'unauthorized access)',
'type_of_data_compromised': 'Secrets, Sensitive System Data'},
'date_detected': '2023-10-19T16:21:00',
'description': 'French cloud provider OVHcloud confirmed that attackers '
'hijacked its open-source command-line interface (CLI) tool to '
'distribute information-stealing malware. The breach occurred '
'after a developer’s GitHub account was compromised, allowing '
'the attacker to modify versions 0.11.0 through 0.15.0 of the '
'OVHcloud CLI between 14:47 and 16:21 on October 19. The CLI '
'tool was altered to exfiltrate secrets from infected systems. '
'OVHcloud has since released a clean version (0.16.0) and '
'enabled GitHub’s release immutability feature to prevent '
'future tampering.',
'impact': {'brand_reputation_impact': 'Moderate (Supply chain compromise, '
'open-source tool tampering)',
'data_compromised': 'Secrets, Sensitive System Data',
'identity_theft_risk': 'High (Secrets exfiltration could lead to '
'further breaches)',
'operational_impact': 'Potential unauthorized access to cloud '
'services via exfiltrated secrets',
'systems_affected': 'macOS (Intel/ARM), Linux (x86_64/ARM64), '
'Windows x86-64'},
'initial_access_broker': {'backdoors_established': 'Scripted history '
'rewrites, hidden '
'malicious loaders',
'entry_point': 'Compromised Developer GitHub '
'Account',
'high_value_targets': 'Software development '
'ecosystems (VSCode, GitHub, '
'npm)',
'reconnaissance_period': 'Over six months (account '
'under attacker control)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Risks in open-source supply chains, importance of CI/CD '
'safeguards, GitHub release immutability, and developer '
'account security',
'motivation': 'Data Theft, Exfiltration of Secrets',
'post_incident_analysis': {'corrective_actions': 'Enabled GitHub release '
'immutability, released '
'clean CLI version, advised '
'users to revoke secrets and '
'perform cleanup',
'root_causes': 'Compromised developer account, '
'lack of CI/CD safeguards, GitHub '
'release immutability not enabled'},
'recommendations': 'Enable GitHub release immutability, enforce multi-factor '
'authentication for developer accounts, monitor for '
'unauthorized changes in CI/CD pipelines, revoke and '
'rotate secrets post-compromise, and educate users on '
'supply chain risks',
'references': [{'source': 'OVHcloud CEO Statement'},
{'source': 'OpenSourceMalware Investigation'}],
'response': {'communication_strategy': 'Public advisory to users, CEO '
'statement',
'containment_measures': 'Release of clean CLI version (0.16.0), '
'Enabled GitHub release immutability',
'remediation_measures': 'Revocation of all secrets, System '
'cleanup for affected users',
'third_party_assistance': 'OpenSourceMalware (Investigation)'},
'stakeholder_advisories': 'Users advised to revoke secrets and perform system '
'cleanup',
'threat_actor': 'GlassWorm',
'title': 'OVHcloud CLI Tool Compromised in Malware Attack Targeting Secrets',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Lack of CI/CD safeguards, GitHub release '
'immutability not enabled'}