Attackers replaced the binary releases of OVHcloud's open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer machines, the company confirmed this week. The incident, which affected versions v0.11.0 through v0.15.0, went live on October 19 and was only caught after a customer raised an alarm about a suspicious release.
The malicious files were live for roughly 94 minutes. A customer's CI pipeline, which had a pinned SHA-256 checksum for the v0.15.0 Linux binary, failed when the hash no longer matched, and the customer opened issue #300 on the public GitHub repository. OVHcloud pulled the replaced assets at 14:21 UTC and shipped a clean replacement, v0.16.0, three hours later.
A Compromised Account, Months in the Making
The attack traced back to a single GitHub account: `HassenBF`, belonging to a legitimate OVHcloud contributor who had write access to the release repository. According to the security research group OpenSourceMalware, the account was compromised roughly seven months before the attack, with evidence pointing to early March 2026.
On March 5 and 6, four personal repositories on the account were force-pushed within a scripted window. Three of those rewrites embedded a `preinstall.js` loader file containing a payload hidden inside invisible Unicode variation-selector characters. A fourth repository inlined the same decoder into a React source file. The push cadence for the first three repositories was 42 seconds, which OpenSourceMalware interpreted as automated rather than manual activity.
After that, the account went quiet on the CLI project. It continued contributing to `ovh/ovhcloud-docs` through May to September 2026, with several pull requests merged normally. That cover of normalcy made the account hard to flag.
How the Malicious Binaries Were Built
The attacker did not touch OVHcloud's CI/CD pipeline. Instead, they built the infected packages locally and uploaded them directly using the GitHub Releases API, replacing the macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64 binaries across five versions. The i386, Windows ARM64, and WASM builds were left alone, which OpenSourceMalware read as deliberate targeting of developer and operations workstations.
Critically, the attacker also replaced the `checksums.txt` file last, so the new hashes matched the malicious binaries. Anyone who verified the checksum would still get a false sense of security.
OVHcloud CEO Octave Klaba confirmed that GitHub's release immutability setting had been turned off on the repository, which is what allowed an account with write access to silently overwrite already-published releases without triggering any CI checks. Since the incident, OVHcloud has re-enabled that setting. The v0.16.0 release is now marked immutable, meaning its files cannot be replaced.
A forensic check of the malicious binary using `go version -m` revealed it was built from a git checkout with uncommitted changes (`vcs.modified=true`), a dead giveaway that it came from a local workstation build rather than the official GoReleaser pipeline.
The Payload: A Solana Dead Drop and GlassWorm Fingerprints
OpenSourceMalware dug into the `preinstall.js` file loaded into the compromised account's repositories back in March. The loader uses a two-stage design. The first stage AES-256-CBC decrypts a hex blob, and the resulting second-stage script checks whether the victim machine appears to be based in Russia by testing language and timezone settings; if it is, the script exits after 10 seconds.
Otherwise, it contacts public Solana RPC endpoints, queries transactions from a specific wallet address, and reads a JSON memo embedded in the blockchain. That memo carries a base64-encoded URL pointing to the next-stage payload. This "dead drop" technique lets the attacker swap out the payload URL anytime without touching any code repository.
The Solana wallet in question, `BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC`, appears in public indicator lists for GlassWorm, a threat actor that has been running campaigns since late 2025 targeting VS Code, OpenVSX, GitHub, and npm. OpenSourceMalware attributes this attack to GlassWorm with moderate confidence.
Who Is Affected and What to Do
Any developer or CI pipeline that downloaded or ran the CLI through `install.sh`, the Homebrew cask, or a direct GitHub release between 12:47 and 14:21 UTC on October 19 may have been exposed. Klaba said the malware's goal was to collect secrets sitting on disk, and while he described the binary as low quality, he warned it was still capable of doing real damage.
Affected users should update to v0.16.0 or roll back to v0.10.0 immediately, but updating the tool alone is not enough. Any machine that ran a compromised version should be treated as having all its readable secrets exposed. That means rotating OVHcloud API keys, cloud credentials, SSH keys, Kubernetes configs, package registry tokens, and anything stored in `.env` files, from a separate, clean machine. Users on macOS should also check for an `~/init.json` file in the home directory, which the second-stage script writes as a throttle marker.
OVHcloud has said a full post-mortem is coming. Key questions remain open: how the developer account credentials were first stolen, whether the same actor maintained access for the entire seven months, and exactly what the final payload did before OVHcloud deleted the files.
