What Happened
The Hacker News reports attackers used a hijacked contributor GitHub account to replace download archives on OVHcloud CLI releases v0.11.0 through v0.15.0 on October 19. The malicious files went live at 12:47 UTC and stayed up to 94 minutes. The builds steal secrets stored on disk. The source code, release tags, and build pipeline were not changed. A customer’s CI job, which pins a SHA-256 hash, caught the swap. OVHcloud published a clean, immutable v0.16.0 and enabled release immutability, the setting it lacked. OpenSourceMalware links the account to the GlassWorm campaign but calls the link an inference.
Why This Matters for Canadian Organizations
OVHcloud serves Canadian customers, and Canadian teams automate against its API with this CLI. The exposure paths are ordinary. The official install script never checked a hash. Direct downloads and CI jobs without pinned hashes also fetched the bad archives, and so did the CLI’s own upgrade command on some versions.
The malware reads secrets from the machine, which includes API credentials in ~/.ovh.conf. A stolen cloud credential is a path to customer data, so a missed rotation becomes a PIPEDA breach question. Regulated firms should also log this as a third-party software event under OSFI Guideline B-13.
What to Do
Check every host and CI job for a download or upgrade between 12:47 and 14:21 UTC on October 19. If a swapped build ran or you cannot tell, rotate every secret readable from the machine, working from a different machine. Remove the binary, install v0.16.0, and verify it with gh release verify-asset. Pin hashes in CI and in install scripts. Homebrew, go install, source builds, and the Docker image were not exposed. Read more in our TechTalk coverage and our News archive.
