OVHcloud says GitHub-hosted CLI releases were tampered with to steal secrets

The company has re-enabled release immutability after blocking the altered packages and tells affected users to clean systems and rotate secrets.

OVHcloud says attackers tampered with its GitHub-hosted CLI releases and used them to ship malware that was meant to harvest secrets from developers’ machines. The company says versions 0.11.0 through 0.15.0 were altered, while 0.10.0 and 0.16.0 were clean, and that the malicious release first appeared at 14:47 on October 19 before being detected and blocked at 16:21. CEO Octave Klaba said the abuse relied on GitHub release immutability being disabled, which let a privileged account change releases without triggering CI/CD checks. OVHcloud has turned on release immutability again and is telling anyone who downloaded a compromised package to clean their system and rotate all secrets. OpenSourceMalware separately said the incident may be tied to a GlassWorm campaign and that source builds and Docker images were not affected.