On 19 October 2026, a compromised OVHcloud developer account was used to replace the GitHub release files of ovhcloud-cli v0.11.0 to v0.15.0 with a trojanised build that steals SSH keys and cloud credentials. About 250 downloads occurred before removal; anyone who installed the tool in that window must rotate their secrets.
What happened
On 19 October 2026, between 14:47 and 16:21 (Paris time), the official binaries of ovhcloud-cli, the command-line tool used to manage OVHcloud accounts and services, were replaced on GitHub with malicious copies. According to OVHcloud’s security advisory, a compromised GitHub account belonging to one of its developers was used to swap the release files of versions v0.11.0 to v0.15.0 for macOS, Linux and Windows. A customer noticed because its CI pins file checksums, and reported it publicly at 15:50. The files were removed at 16:21, and a clean, signed and immutable v0.16.0 followed at 19:16. OVHcloud counts about 250 downloads during the window.
How the attackers got in
OVHcloud says the developer’s personal laptop had been infected a year earlier, on 20 October 2025, by a malicious code-editor extension tied to the Glassworm group; keys stolen at the time were used to upload the files. The repository did not enforce immutable releases, so published files could be overwritten. Source code, the build chain and OVHcloud’s internal CI were not affected, according to the company. The trojanised CLI works normally but collects SSH keys, AWS, Google Cloud and Azure credentials, Docker and Kubernetes configurations, npm, Terraform and DigitalOcean tokens, .netrc, Git settings and data from code editors and AI assistants, then sends the archive to a remote server.
What to do now
- Check whether you downloaded the CLI on 19 October between 14:47 and 16:21 (Paris time), on workstations, CI runners and servers alike.
- Do not run the binary: compute its hash with
md5sumand compare it with the five MD5 hashes published in the advisory. - Look for the malware’s trace: a folder named
envchecker-followed by digits in the temporary directory (ls -d /tmp/envchecker-*, or under$TMPDIRon macOS). - If affected: treat every secret on the machine as compromised, revoke and replace SSH keys, cloud keys, kubeconfig files and registry or npm tokens, plus your OVHcloud API keys as a precaution; block
45.32.148.174and review your cloud logs. - Reinstall version v0.16.0 or later.
Our take
An admin tool installed on a workstation or a CI runner holds the keys to the whole infrastructure. Pin and verify the checksums of the binaries you download, as the customer who raised the alarm did, avoid long-lived secrets in plain files, and keep track of the extensions installed on your developers’ machines.
Sources
- OVHcloud (GitHub security advisory) — ovhcloud-cli security incident - October 19th, 2026
- GitHub ovh/ovhcloud-cli — Release assets of v0.13.0–v0.15.0 replaced on 2026-10-19
- ZDNET France — OVHcloud : une attaque sur son compte GitHub expose ses utilisateurs à un malware
How we choose, verify and write our analyses →
The way in was a third party. Check what your suppliers expose publicly — no intrusion, public information only:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
