An attacker took over a contributor's GitHub account and swapped the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19, replacing them with a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says.
The malicious files were live for up to 94 minutes, from 12:47 to 14:21 UTC, and reached only people who installed or updated the OVHcloud CLI during that window through a path that checks no hash, on macOS, Linux x86_64 or arm64, or Windows x86_64.
OVHcloud deleted the swapped archives and published a clean v0.16.0 that evening as an immutable release, whose files GitHub will not let anyone change. The source code, the release tag and the company's build pipeline were untouched: the bad build was a plain go build of a later commit, uploaded straight onto releases published between April and September.
On v0.15.0 the attacker replaced six files - the macOS x86_64 and arm64 archives, the Linux x86_64 and arm64 archives, the Windows x86_64 archive, and checksums.txt, so the published hashes matched the new binaries. The same six files are now gone from v0.11.0 through v0.14.0. The Linux i386, Windows i386, Windows arm64 and WebAssembly builds were left alone on every release. OVHcloud lists v0.11.0 through v0.15.0 as compromised and v0.10.0 as clean.
You were exposed if, in that window and on one of those platforms, you ran the official install script, downloaded an archive from any of the five release pages, ran a CI job fetching the archive without a pinned hash, or used the CLI's own upgrade command from a v0.12.0, v0.13.0 or v0.14.0 install on macOS or Linux. You were not exposed if you installed with Homebrew, whose cask pinned the original SHA-256 and would have refused a mismatched download; used go install or built from source; pulled the Docker image, last pushed September 21; or installed before 12:47 UTC and did not update during the window. Some early write-ups listed Homebrew among the exposed paths, but The Hacker News checked the tap's commit history and found nothing changed between the v0.15.0 cask on September 16 and the v0.16.0 cask on Monday evening.
A customer's CI job caught the swap because it pins the SHA-256 of the Linux arm64 archive and began failing. With no private reporting channel on the repository, the customer filed a public issue at 13:50 UTC, and OVHcloud deleted the swapped files about half an hour later. v0.16.0 followed at 17:16 UTC.
OVHcloud founder Octave Klaba wrote on X that anyone affected should change every secret stored on the disk. OpenSourceMalware, which investigated the incident, adds that rotation should be done from a different machine. Remove the binary and install v0.16.0, and check a downloaded archive with gh release verify-asset v0.16.0 FILE.
The problem stemmed from GitHub's release immutability option not being enabled, Klaba wrote, so a user with the right permissions could modify existing releases directly without any checks by the company's CI/CD pipeline. The option has now been enabled. The uploads came through the account of a contributor whose merged work is in OVHcloud's documentation repository and who is not a public member of the organization, according to OpenSourceMalware, which built a timeline from GitHub's server-side records. First checks found no other repository affected, and OVHcloud has not said how the account's credentials were taken.
OpenSourceMalware ties the account to GlassWorm, the malware campaign that hides code in invisible Unicode characters and fetches its next stage from the memo field of a Solana wallet's transactions. Four of the account's personal repositories were force-pushed in March with an amended commit that added a loader of that kind, the researchers found. Whether the same actor did both is "our inference," they wrote, and nothing from the October binary has been tied to GlassWorm because no copy of it was preserved. OVHcloud has promised a detailed postmortem.
Source: The Hackers News