OVHcloud CLI review: Security Risks from the October 2026 Malicious Release

OVHcloud CLI users faced a supply-chain compromise on October 19, 2026, when attackers published malicious binaries for five release versions. The window lasted roughly 94 minutes and affected only those who downloaded during that period from GitHub. No source code or build systems were breached.

OVHcloud CLI review: Timeline and Technical Details of the Attack

Attackers gained access to a developer GitHub account named HassenBF and used it to overwrite release assets. The malicious files carried a stripped Go binary with embedded envchecker stealer logic. This payload scanned for configuration files including ~/.ovh.conf, environment variables, SSH private keys, and credentials for AWS, GCP, Azure, Docker, Kubernetes, Terraform, and Git.

The malware staged collected data in temporary directories named envchecker-XXXX before attempting exfiltration over Solana RPC endpoints and a hardcoded IP address. OVHcloud confirmed that the repository lacked release immutability, which allowed direct asset replacement without triggering any CI workflows. Source code, the build pipeline, and all other repositories remained untouched.

A customer CI pipeline detected the tampering when SHA-256 hashes for the v0.15.0 Linux arm64 archive failed to match the pinned value. This mismatch triggered a public GitHub issue that prompted OVHcloud to remove the tainted files by approximately 14:21 UTC. The company released v0.16.0 the same day with signed tags and enabled release immutability across the organization.

Impact Assessment and User Exposure

Only users who installed or upgraded via GitHub releases, the official install script, or specific upgrade paths between roughly 12:47 and 14:21 UTC encountered the malicious binaries. Earlier versions up to v0.10.0 and the new v0.16.0 release were unaffected. OVHcloud reported approximately 250 downloads during the exposure window, though no confirmed cases of data exfiltration have been published.

The compromise has been linked by OpenSourceMalware to the GlassWorm threat actor, previously associated with browser-extension attacks and Solana wallet activity. OVHcloud advised affected users to rotate all secrets that could be read from the compromised machine, preferably from a clean system, and to delete any suspect binary before installing the clean v0.16.0 release.

Security teams should verify the integrity of any OVHcloud CLI installation performed on October 19, 2026. Checking release signatures on current installations and reviewing access logs for unusual outbound connections to Solana RPC endpoints provide additional verification steps. Organizations that pin CLI versions by hash avoided the issue entirely.

Current Status and Hardening Measures

OVHcloud has restored clean releases and implemented release immutability as a permanent control. The incident highlights the importance of signed releases and immutable assets for open-source CLI tools. Users who require the tool for production workloads can now install v0.16.0 with greater assurance that the binary has not been altered after publication.

Teams managing multiple cloud providers should maintain separate credential stores and rotate keys on a regular schedule regardless of this event. Monitoring for unexpected processes that read configuration directories remains a practical defense against similar future attempts.