OVHcloud CEO Octave Klaba posted on X on Oct 19 that the company's CLI repository (ovh/ovhcloud-cli) had been abused through a developer's GitHub account. The attacker added a binary "whose job is to retrieve the secrets on the disk". Klaba called the quality poor but said "it can go all the way". Affected: v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0. v0.10.0 and v0.16.0 are clean. Klaba's times (14h47 to 16h21) are Paris time, which works out to 12:47 to 14:21 UTC. A customer whose CI pinned a SHA-256 hash caught the change and reported it. In a follow-up, Klaba said the CI/CD pipelines (tests, CVE detection) weren't affected. The gap was that GitHub's release-immutability option was off, so an account with the right permissions could replace assets on existing releases directly. The option is now on, and OVHcloud considers the incident closed. It has promised a post-mortem.

OpenSourceMalware's Oct 20 analysis, based on GitHub server-side records, says the uploads came through a legitimate OVH contributor's account via the ordinary Releases API. No tag was pushed and no workflow ran. The attacker replaced only the mainstream archives (macOS x86_64/arm64, Linux x86_64/arm64, Windows x86_64) and checksums.txt, so the published hashes matched the malicious files. The i386, Windows arm64 and WASM builds were left untouched. The researchers tie the contributor account to a GlassWorm-style compromise from March 2026 (a Solana-memo dead-drop loader in its personal repos). They label that link an inference, and they did not analyze the payload because OVHcloud deleted the files first. Sources disagree on Homebrew: THN reports the cask pinned the original hashes, while OpenSourceMalware lists brew install as an exposed path. Check your own install logs.

Do now: if any machine or CI job installed or updated the OVHcloud CLI on Oct 19 between 12:47 and 14:21 UTC (via install.sh, a GitHub release download, the CLI's own upgrade command, or possibly Homebrew), treat it as compromised. Remove the binary, rebuild if you can, and revoke every secret that was on that disk: OVHcloud API credentials, cloud keys, SSH keys, tokens. Then install v0.16.0. Copies installed before 12:47 UTC on Oct 19 and not updated since, Go module or source builds, and Docker images are not affected.