GoKawiilOVHcloud CLI Tool on GitHub Compromised by GlassWorm-Linked Attackers
OVHcloud confirmed that a compromised developer GitHub account was used to replace legitimate releases of its open-source ovhcloud-cli tool with malicious binaries designed to steal secrets from users' disks. The tainted versions were available for about 90 minutes and downloaded roughly 250 times before a user flagged suspicious activity, prompting OVHcloud to remove them within 30 minutes. CEO Octave Klaba urged affected users to update or delete the tool and rotate any exposed secrets.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident is linked to GlassWorm, a self-propagating malware campaign that has repeatedly targeted software supply chains since October 2025, suggesting attackers are systematically hunting for high-profile developer accounts to exploit. Even a short exposure window can have outsized consequences in supply-chain attacks, since downloaded malicious binaries can persist and spread on user systems long after the source is cleaned up. The breach underscores how a single compromised developer credential can expose an entire open-source distribution pipeline.
- OVHcloud's ovhcloud-cli GitHub repo was briefly compromised via a hijacked developer account.
- Malicious binaries capable of stealing disk secrets were live for about 90 minutes and downloaded ~250 times.
- The attack is attributed to the GlassWorm threat actors, known for self-propagating supply-chain campaigns.
YubiKey 5 NFC Security Key — Supply-chain attacks like this one often hinge on stolen developer credentials and compromised GitHub accounts. A hardware security key like the YubiKey adds phishing-resistant multi-factor authentication to GitHub and other dev tools, making it far harder for attackers to hijack accounts even if secrets are exposed. It's a practical step for any developer looking to harden their workflow after incidents like this.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Rob Wright, 2026-10-21
Published there as: “OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.