OVHCLOUD disclosed that one of its GitHub repositories was compromised after threat actors gained access via a developer’s GitHub account and replaced legitimate releases in the ovhcloud-cli project with malicious binaries. Affected users who downloaded the latest version were advised to update quickly or delete the tool. OVHcloud’s postmortem notes that the malicious binaries were available for about one hour and thirty-three minutes, during which roughly 250 downloads occurred.
Affected activity appears limited to the release itself, with the main production CI/CD pipeline running on a private Git repository, thus not impacted by the GitHub compromise.
Security researchers have tied the activity to the GlassWorm threat actors, a self-propagating group known for supply-chain and worm-like behaviour. The post notes that the exploit involved a compromised developer account and a pre-release manipulation that enabled an attacker to deliver a loader and a second stage using a Solana memo dead drop, linking the wallet address to GlassWorm indicators in prior campaigns.
OVHcloud’s incident response highlighted a misconfiguration as the enabling factor: the GitHub release immutability was not correctly enforced, allowing assets to be altered after publication. The configuration has since been corrected, and the same measure has been applied across all repositories. The incident emphasises how a personal device compromise can translate into broader enterprise risk, even when source code remains untouched.