French cloud computing and web hosting company OVHcloud says a hacker used the GitHub account of one of its developers to plant a secret-stealing binary in its official command-line interface (CLI) tool.
The supply chain incident occurred on October 19, and OVHcloud lists versions v0.11.0 through v0.15.0 as compromised. Version 0.10.0 and the newly released version 0.16.0 are clean.
“The hacker used the GitHub account of one of the developers and added a binary whose job is to retrieve secrets from the disk. The quality of the binary is poor but it can go all the way,” OVHcloud founder Octave Klaba said on X (translated from French).
Klaba said the compromised version appeared at 14:47 Paris time and was blocked at 16:21, after a customer reported the issue. According to OpenSourceMalware, a user flagged the tampering publicly on GitHub after an automated hash check failed.
The CI/CD pipelines were not impacted, Klaba noted in a different post, as the issue stemmed from GitHub’s release immutability option not being enabled.
“As a result, a user with the appropriate permissions could directly modify existing releases on GitHub without any checks from our CI/CD,” Klaba said. The option has since been enabled.
OpenSourceMalware says the attacker uploaded the binary over the original files of already published releases. Only builds for the most common platforms were replaced, which the researchers believe points to credential harvesting on developer and operations workstations.
The account belongs to a legitimate OVHcloud contributor. According to the researchers, it had been compromised since at least March 2026, when four of its personal repositories were rewritten, three of them to include a hidden loader.
The loader’s next stage queries the Solana blockchain for the location of a further payload, using a wallet that is a known GlassWorm indicator.
However, the researchers could not confirm that the same actor was behind the March account compromise and the October attack. “Whether the same actor did both is our inference,” they said. OVHcloud has not mentioned GlassWorm in its statements.
OpenSourceMalware could not obtain a sample of the payload for analysis before OVHcloud deleted the malicious files.
Users who installed or updated the CLI on macOS, 64-bit Linux, or Windows x86_64 via the official install script, Homebrew, or a direct GitHub download during the roughly 94-minute window are affected. Those who built from source, used Go’s install command, or pulled the official Docker image are not.
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Related: AI Platform Cairn Abused to Hack Over 100 Organizations
Related: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
