OVHcloud's CLI was backdoored on GitHub for 94 minutes
A hijacked developer account pushed secret-stealing malware into five releases of the OVHcloud command-line tool before the company caught it.
On 19 October, an attacker used a hijacked developer’s GitHub account to push a malicious release of the OVHcloud command-line tool. Versions 0.11.0 through 0.15.0 carried a backdoor built to pull secrets off the disk of anyone who installed it. OVHcloud CEO Octave Klaba said the compromised build went out at 14:47 UTC and was blocked at 16:21 UTC, a window of roughly 94 minutes.
A customer flagged the bad release before OVHcloud’s own checks did. Builds for macOS, Linux and Windows were all affected; source builds and Docker images were not. The hijacked account itself looks to have been compromised for longer: OVHcloud found a scripted rewrite of its git history dated back to March. The clean version is 0.16.0, and OVHcloud has since turned on GitHub’s release immutability setting, which stops a compromised account from quietly modifying a release that has already shipped.
Why it matters: OVHcloud is Europe’s largest cloud provider, and its CLI is how a lot of people script their own infrastructure, which makes it exactly the kind of tool this sort of malware wants access to. If you installed the OVHcloud CLI between those two times on 19 October, update to 0.16.0 or remove it, and rotate anything stored on that machine, not just OVHcloud credentials.
The caveat: OVHcloud has not said how the developer’s GitHub account was first compromised.