Attackers hijack developer credentials to push credential-stealing malware into OVHcloud repository

French hosting provider OVHcloud is warning customers after attackers hijacked a developer's GitHub account to distribute information-stealing malware through its open-source command-line tool. The intrusion modified versions 0.11.0 through 0.15.0 of the OVHcloud CLI on October 19. According to OVHcloud CEO Octave Klaba, the tampered release went live at 14:47 and remained accessible until it was detected and blocked at 16:21 following a customer report. Older version 0.10.0 and the latest release 0.16.0 remain safe. [2]

The threat actors took advantage of a disabled release immutability setting on GitHub, enabling them to bypass regular automated testing pipelines and upload locally compiled binaries. The compromised packages affected macOS, Linux, and Windows systems, while source builds and Docker images remained clean. Despite Klaba describing the malware as poor quality, its primary function was extracting local secrets from users' disks. OVHcloud has turned on GitHub release immutability and considers the incident resolved, but urges affected users to remove the software, clean their systems, and rotate all exposed credentials. [2]

Threat researchers at OpenSourceMalware linked the breach to GlassWorm, an operation active across major developer platforms including VSCode, OpenVSX, and npm. Investigators revealed the compromised account had been infiltrated months earlier in March 2026 using a loader tied to a Solana cryptocurrency memo dead drop. [1][2]