OVHCLOUD has revealed that a developer’s GitHub account was compromised, leading to the insertion of a secret-stealing binary into the company’s official OVHcloud CLI tool. The tampered releases appeared in versions from v0.11.0 up to v0.15.0, with clean builds remaining for v0.10.0 and the newly released v0.16.0. The attacker is reported to have gained access to the developer’s account as early as March 2026, rewriting four personal repositories, three of which were altered to host a hidden loader.
The compromised release was made public at 14:47 local time and was blocked at 16:21 after a customer reported the issue, according to OVHcloud founder Octave Klaba.
OpenSourceMalware and researchers describe the payload as a poor-quality binary designed to harvest secrets from the host disk. The loader’s next stage reportedly queries the Solana blockchain to locate a further payload, using a wallet linked to GlassWorm indicators. It is not clear whether the same actor was responsible for both the March account compromise and the October GitHub tampering; OVHcloud has not named GlassWorm in its statements. OpenSourceMalware did not obtain a sample of the final payload before OVHcloud deleted the malicious files, limiting technical analysis.
Users who installed or updated the CLI via the official install script, Homebrew, or direct GitHub download during the roughly 94‑minute window on macOS, 64‑bit Linux, or Windows x86_64 were affected. Installations built from source, via Go’s install command, or the official Docker image were not impacted. The issue exposed a credential-harvesting risk in developer and operations workstations and prompted enabling release immutability on GitHub.