An attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on 19 October, swapping in a build designed to steal secrets stored on disk. The malicious archives were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC. On each release the attacker replaced six files — the macOS x86_64 and arm64 archives, the Linux x86_64 and arm64 archives, the Windows x86_64 archive and checksums.txt, so the published hashes matched the new binaries; OVHcloud lists v0.11.0 through v0.15.0 as compromised and v0.10.0 as clean. OVHcloud deleted the swapped archives and published a clean, immutable v0.16.0 that evening; the source code, release tag and build pipeline were untouched, the malicious build being a plain go build of a later commit. Anyone who ran the official install script, downloaded a release archive, ran a hash-unpinned CI job or used the CLI's own upgrade command in that window should rotate credentials. Homebrew installs, go install, source builds and the Docker image were unaffected. OpenSourceMalware attributes the activity to its Glassworm tracking.

• Source article