French cloud computing company OVHcloud warned its users that its open-source command-line interface (CLI) tool was compromised, as a developer's account was exploited to access the code repository on GitHub and modify specific versions of the tool to plant malware.
Details of the Breach and Affected Versions
The company's CEO, Octave Klaba, explained that the attack targeted versions v0.11.0 through v0.15.0. The suspicious activity was detected on October 19, 2026, where attackers managed to bypass standard CI/CD verification processes by exploiting the disabling of the "Release Immutability" feature in the GitHub repository, allowing them to upload locally built trojanized packages.
The company confirmed that the older version (v0.10.0) and the newer version (v0.16.0) are completely safe and unaffected by the attack. Investigations also indicated that the attack may be linked to GlassWorm, an active threat campaign since late 2025 that has targeted multiple software development environments.
What This Means for Users
The primary goal of the malware is to extract "secrets" stored on the disks of developers' and system administrators' devices. Since the tool is used to manage cloud and hosting services, any device that ran the infected versions is considered fully compromised.
- Affected Systems: macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64.
- Safe Systems: Docker images and source builds were not affected.
Required Remediation Steps
OVHcloud strongly recommends that all users who downloaded the affected versions take the following actions immediately:
- Completely remove the infected tool from the system.
- Perform a comprehensive system clean-up.
- Change and revoke all secrets and API keys that were stored on the device, as they are assumed to be in the possession of the attackers.
The company has enabled the "Release Immutability" feature in GitHub to prevent future unauthorized modifications of this kind, considering the incident contained.