French cloud computing and web hosting company OVHcloud suffered a software supply chain breach after a hacker managed to use the GitHub account of one of the company's developers to plant data-stealing malware inside the company's official command-line interface (CLI) tool.
The incident occurred on October 19. OVHcloud stated that versions v0.11.0 through v0.15.0 were affected by this breach, while the older version v0.10.0 and the new version v0.16.0 remained safe and clean from any malicious modifications.
Breach Details and Attack Window
Octave Klaba, the founder of OVHcloud, explained that the attacker added a critical executable file whose function was to extract secrets and data from hard drives. Although he described the code quality as poor, it was capable of completing its mission. The compromised version appeared at 14:47 Paris time and was blocked at 16:21 after receiving an alert from a customer, as a user publicly reported the tampering after an automatic hash check failed.
Klaba pointed out that the continuous integration and continuous delivery (CI/CD) pipelines were not affected by the attack, explaining that the main issue stemmed from not enabling the release immutability standard on GitHub, which allowed a user with the appropriate privileges to modify published releases directly without passing them through the company's system checks.
Monitoring Connections and Malware
Security researchers at the OpenSourceMalware platform reported that the attacker replaced the original files of previously published releases, and the replacements were limited to packages intended for the most common platforms, hinting at a potential targeting of credentials on developer and operator workstations.
The targeted account belongs to a legitimate contributor to the company, and investigations indicate it was compromised since at least March 2026, where personal repositories were modified and a covert loader relying on the Solana blockchain network was embedded to locate an additional payload via a wallet associated with malware indicators known as GlassWorm, though researchers could not confirm whether the same attacker was behind the March breach and the October attack.
What Changes Practically for Users?
Users who installed or updated the CLI tool on macOS, Linux 64-bit, or Windows x86_64 systems during a time window not exceeding 94 minutes were affected by the incident, via the official installation script, the Homebrew package manager, or direct download from GitHub. Meanwhile, users who built from source, used the Go language installation command, or pulled the official Docker image were not affected.