OVHcloud CLI Releases Backdoored on GitHub to Steal Developer Secrets

· Cybersecurity · France

French cloud and hosting provider OVHcloud warned users that attackers compromised its open-source command-line interface tool to distribute information-stealing malware. An attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases of the CLI on Monday, October 19, according to reporting on October 20. The replacement files were a build designed to steal secrets stored on the disk of any machine that runs the tool. The incident is the latest in a series of software supply chain compromises, in which trusted download channels become the delivery mechanism for credential theft aimed at developers and cloud operators.

Why it matters：Developer tooling and package channels are increasingly the entry point for credential theft, and a compromise at a European cloud provider can expose secrets that grant access to customer infrastructure.

Key points

  • Five existing CLI releases were replaced with malicious archives
  • A hijacked contributor GitHub account was used
  • The malware targets secrets stored on the executing machine's disk

Sources (original reporting)

More stories from this day