AN attacker compromised a contributor’s GitHub account and replaced the download archives for five OVHcloud CLI releases. The swap occurred on Monday, 19 October 2026, between 12:47 and 14:21 UTC, and targeted users on macOS, Linux x86_64 or arm64, and Windows x86_64 who installed or updated during that window. The malicious builds were designed to steal secrets stored on the host disk.
OVHcloud states the bad files were uploaded as a plain go build of a later commit and bypassed the usual hash checks, meaning the altered releases appeared legitimate to users who did not pin hashes. The company subsequently deleted the swapped archives and published a clean v0.16.0 immutable release that evening.
Evidence and scope show five releases were compromised: v0.11.0 through v0.15.0. The attacker swapped six files on v0.15.0 (macOS, Linux, Windows archives and a checksums[.]txt) to align the published hashes with the malicious binaries; other builds (Linux i386, Windows i386, Windows arm64, WebAssembly) were left intact.
The only publicly verified swapped hash given is for the Linux arm64 archive of v0.15.0: 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb versus the original 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0. OVHcloud has advised affected users to rotate every secret stored on disk, to install v0.16.0 from the immutable release, and to verify assets with GitHub’s verify-asset command. The incident is being linked to a contributor with documented ties to GlassWorm, though no direct malware sample was publicly preserved from this event.