Malware · October 23, 2026 · 3 min read

OVHcloud CLI downloads were swapped for a secret-stealer

For about 94 minutes on October 19, GitHub release files for CLI versions 0.11.0 through 0.15.0 were replaced. Copies downloaded before that window were not.

BBrody · Frame

A dark terminal window on black, and a dashed block sitting where a solid file used to be.

On October 19, 2026, OVHcloud says a compromised developer account replaced the published binaries of its command-line tool on GitHub. The bad files were available for one hour and 33 minutes. OVHcloud’s count of downloads in that window is about 250. If you installed the CLI on any other day, the company says you did not get this copy.

What was replaced

OVHcloud’s advisory says the malicious binaries were uploaded between 14:47 and 16:21 in France (12:47 to 14:21 UTC) on October 19. The affected releases are v0.11.0 through v0.15.0. The source code and the build pipeline were not changed, and the company says no other OVHcloud repository was. Release v0.10.0 and anything older are unaffected. v0.16.0, published later that evening with a signed tag, is the clean release.

The reason a replaced file could be uploaded onto an existing release is that GitHub’s setting for immutable releases was off. OVHcloud says it turned that setting on, including on its other repositories.

The company traces the developer account to a malicious browser extension, color-picker-universal 2.8.91, installed on that person’s personal Mac in October 2025 and linked to the Glassworm activity. It says the CLI files were replaced with stolen keys, not from the OVHcloud laptop, which it has not found to be compromised. The CEO, Octave Klaba, described the binary as poor quality and still able to read secrets off disk, and told anyone affected to change the secrets on that disk.

A customer report came in at 15:50 France time. The binaries were removed at 16:21.

How to tell, without running the file

Don’t run the binary to see if it’s bad. OVHcloud says to compare its MD5 with the hashes in the advisory, or to look in the temp directory for a folder named envchecker- followed by digits. Hashes and the folder check are in the advisory. A match means that copy was the replaced one.
Only the download window matters. A copy of v0.11.0 through v0.15.0 that you downloaded before October 19, and did not update during those 94 minutes, is the original build. A download during the window, on the platforms the advisory lists, is the one to treat as malicious.
If it ran, rotate secrets from a different machine. Klaba’s instruction is to change the secrets that were on the disk where the binary ran. That includes cloud keys, SSH keys, and anything the CLI’s user could read. Do the rotation from a machine that did not run the file. Then install v0.16.0 or later, rather than re-downloading an older release asset.
Most OVHcloud customers never installed this CLI. The control panel in a browser is not this incident. The incident is the ovhcloud command-line program taken from those GitHub releases on that afternoon.

Sources

OVHcloud, ovhcloud-cli security incident - October 19th, 2026, October 20, 2026
BleepingComputer, OVHcloud CLI releases backdoored on GitHub to steal developer secrets, October 2026

New posts, by email.

About once a month. Plain-language privacy notes, nothing else. I never share your address.

What was replaced

A customer report came in at 15:50 France time. The binaries were removed at 16:21.

How to tell, without running the file

Don’t run the binary to see if it’s bad. OVHcloud says to compare its MD5 with the hashes in the advisory, or to look in the temp directory for a folder named envchecker- followed by digits. Hashes and the folder check are in the advisory. A match means that copy was the replaced one.

Only the download window matters. A copy of v0.11.0 through v0.15.0 that you downloaded before October 19, and did not update during those 94 minutes, is the original build. A download during the window, on the platforms the advisory lists, is the one to treat as malicious.

If it ran, rotate secrets from a different machine. Klaba’s instruction is to change the secrets that were on the disk where the binary ran. That includes cloud keys, SSH keys, and anything the CLI’s user could read. Do the rotation from a machine that did not run the file. Then install v0.16.0 or later, rather than re-downloading an older release asset.

Most OVHcloud customers never installed this CLI. The control panel in a browser is not this incident. The incident is the ovhcloud command-line program taken from those GitHub releases on that afternoon.