OVHcloud CLI security review after the October 2026 supply-chain incident

OVHcloud CLI security came under scrutiny after a supply-chain compromise on October 19, 2026. Attackers replaced binaries in five releases for roughly 94 minutes, and the malicious files contained an info-stealer aimed at cloud credentials and developer secrets.

The incident began when a contributor account, compromised since March 2026, was used to swap release assets on the ovh/ovhcloud-cli GitHub repository. Only the Windows, macOS, and Linux binaries plus checksums.txt were altered; source code and CI pipelines remained untouched.

Timeline and technical details of the compromise

The hijacked account replaced assets for versions 0.11.0 through 0.15.0 between 14:47 and 16:21 Paris time. Approximately 250 downloads occurred during this window. Researchers traced the initial account takeover to a malicious VS Code extension installed on the developer’s personal machine around October 2025.

The backdoored binaries were built locally rather than through official pipelines. Running go version -m on an affected file reveals a pseudo-version string and commit hash 5ead8ef, which differ from legitimate builds. The malware collected AWS, GCP, Azure, SSH, Docker, Kubernetes, Terraform, and AI coding tool data before exfiltrating archives via Solana RPC endpoints.

GitHub release immutability was not enabled on the repository, allowing the attacker to overwrite existing assets. No other OVHcloud repositories were affected. The company deleted the malicious files by 16:21 Paris time and issued advisory GHSA-862f-55f5-vmvw the same day.

User exposure and recovery steps

Only users who installed or updated OVHcloud CLI via the official script, Homebrew, or direct GitHub download between 12:47 and 14:21 UTC on October 19 face risk. Downloads made before or after the window, including all versions up to 0.10.0, remain clean.

Users who obtained any affected binary should delete it immediately. They must rotate every secret stored on the machine, including cloud access keys, SSH keys, Git credentials, and API tokens for services such as Terraform or container registries. OVHcloud released version 0.16.0 the same evening with signed tags and immutability enabled across the organization.

Verification of the new release can be performed with the gh release verify-asset command where available. OVHcloud has stated it will conduct broader GitHub policy reviews and pipeline audits; no additional incidents have been reported as of October 23, 2026.

Longer-term implications for CLI users

Supply-chain attacks on developer tools remain difficult to detect because the malicious code arrives through the same channel users already trust. In this case the short exposure window and rapid response limited the number of compromised installations, yet the targeted data types show attackers continue to focus on credential harvesting.

Organizations that rely on OVHcloud CLI should add binary hash checks to their deployment scripts and consider pinning to signed releases. Regular rotation of machine credentials, especially after any tool update, reduces the blast radius if a future compromise occurs.

Users can also monitor the official GitHub security advisories page for the repository and subscribe to release notifications. These practices help maintain OVHcloud CLI security even when an upstream repository experiences a brief asset replacement.