GoKawiilOVHcloud CLI tool compromised on GitHub, served secret-stealing malware
OVHcloud confirmed that an attacker hijacked a developer's GitHub account and altered releases 0.11.0 through 0.15.0 of its open-source CLI tool to distribute information-stealing malware. CEO Octave Klaba said the tainted release went live at 14:47 on October 19 and was pulled by 16:21 after a customer flagged it, while versions 0.10.0 and 0.16.0 remained unaffected.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a disabled GitHub release-immutability setting let an attacker tamper with published binaries without triggering the project's CI/CD checks, a gap that could affect other open-source distribution pipelines. Researchers at OpenSourceMalware suggest the attack may be linked to a broader campaign called GlassWorm, which if confirmed would indicate a coordinated effort targeting developer tooling rather than an isolated breach.
- Versions 0.11.0 to 0.15.0 of the OVHcloud CLI were modified to steal secrets from disk.
- A compromised developer GitHub account combined with disabled release immutability enabled the tampering.
- Affected users are urged to update, clean their systems, and rotate all stored secrets.
YubiKey 5C NFC Security Key — This supply-chain attack highlights how compromised developer accounts can lead to malicious code distribution. A hardware security key like the YubiKey adds strong two-factor protection to GitHub and other developer accounts, making it far harder for attackers to hijack credentials and push backdoored releases.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-20
Published there as: “OVHcloud CLI releases backdoored on GitHub to steal developer secrets”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.