Attackers backdoor five OVHcloud CLI releases on GitHub to steal developer secrets from disk

OVHcloud disclosed that five releases of its open-source command-line tool, versions 0.11.0 through 0.15.0, were backdoored on GitHub to steal secrets from disk. An attacker who had controlled a developer's GitHub account for more than half a year modified the existing releases because GitHub release immutability was disabled, uploading locally built malware without touching the CI/CD pipeline, and planted a hidden preinstall.js loader. OpenSourceMalware linked it to the GlassWorm campaign. The malicious builds covered macOS, Linux, and Windows and were live from 14:47 to 16:21 UTC on October 19. Source builds and Docker images were unaffected, and users should revoke secrets.

Check

Identify machines that ran OVHcloud CLI versions 0.11.0 through 0.15.0, remove or update the binary, clean the systems, and revoke all secrets they could reach.

Affected

Developers who installed the backdoored OVHcloud CLI releases on macOS, Linux, or Windows had secrets stolen from disk by locally built malware uploaded to GitHub.

Fix

Update to a clean OVHcloud CLI release, rotate all exposed secrets, enable GitHub release immutability on your own repositories, and inspect hosts for the preinstall.js loader.