OVER a five-release window on 19 October 2026, an attacker swapped binaries for OVHcloud’s official OVHcloud CLI (ovhcloud-cli) across v0.11.0 to v0.15.0, remaining active for about 94 minutes and deleting the evidence before OVHcloud or customers could archive copies. The entry used a GitHub account tied to an OVHcloud contributor (HassenBF) and replaced assets in place, including checksums.txt for some releases, thereby letting the attacker’s credential-stealing payload appear as the published files.
The swap was detected when a customer’s pinned SHA-256 check failed for the Linux arm64 tarball, triggering investigation and forensic replay. A clean, immutable v0.16.0 release was then published with attestations. OVHcloud’s advisory GHSA-862f-55f5-vmvw details the incident and remediation.
The research re-created the attack chain, confirming three findings: install[.]sh did not expose arm64 Linux, Homebrew casks were not an exposure path, and a single ovhcloud version command could reveal the malicious build. The incident involved a GlassWorm-style loader and a Solana dead drop, with an exfiltration archive posted to a remote endpoint and staging directories created under /tmp/envchecker-*.
The practical response advised by the advisory is to treat any binaries downloaded between 12:47 and 14:21 UTC on 19 October 2026 as fully compromised, rotate secrets from a separate machine, reinstall from v0.16.0 after verifying with gh release verify-asset, and audit CI pipelines for exposed credentials. Public evidence points to a credible, end-to-end replay and a concerted effort to conceal the swap via non-pipeline builds and manipulated release assets.