OVHcloud CLI Supply Chain Attack: Release Assets Replaced to Steal Developer Secrets

1. Basic Information

• Article Title: ovhcloud-cli security incident - October 19th, 2026
• Publisher: OVHcloud
• Publication Date: 2026-10-20
• Original: OVHcloud
• Related Sources: GitHub issue #300, BleepingComputer: OVHcloud CLI releases backdoored on GitHub to steal developer secrets
• Related Malware & Threat Groups: envchecker stealer, GlassWorm
• Related CVEs: None
• Related Products: OVHcloud CLI, GitHub Releases, VS Code, Cursor, Claude, OpenCode, AWS CLI, Google Cloud SDK, Azure CLI, Kubernetes, Terraform
• Severity: Critical
• Severity Basis: A software supply chain compromise in which binaries distributed under legitimate release names contained code designed to collect and exfiltrate credentials and other secrets for AWS, GCP, Azure, Kubernetes, Docker, SSH, Terraform, and AI coding tools. The capabilities are confirmed; successful theft on individual endpoints remains unconfirmed.
• Update Reason: Updated to align the primary source, prerequisites, observation scope, confidence statements, and ATT&CK mappings with primary sources and official specifications. This editorial update is distinct from the original source's publication or update timestamp.

2. Overview

Using stolen GitHub keys associated with GlassWorm, attackers compromised an OVHcloud developer account and progressively replaced CLI release assets for versions v0.11.0 through v0.15.0 with binaries containing information-stealing malware between 14:47 and 16:21 (UTC+2) on October 19, 2026. Approximately 250 downloads occurred during this window, and executing the tampered binaries targeted cloud, SSH, and developer secrets on the affected devices.

3. Attack Flow

1. Developer Key Theft (October 2025): GitHub authentication keys were stolen via a malicious extension (color-picker-universal 2.8.91) installed on a developer's personal Mac.
2. Official Release Asset Replacement (October 19, 2026): Attackers abused developer privileges and mutable release settings on GitHub Releases to progressively replace release assets for v0.11.0 through v0.15.0 with locally built malicious binaries.
3. Download and Execution by Users: Users downloaded the affected binaries from official GitHub releases and executed them on their devices (execution can occur after the distribution window and still fall within the incident's scope).
4. Secret Collection and Exfiltration: The envchecker component within the binary gathered development environment and cloud secrets into a temporary directory, archived them, retrieved exfiltration destination details via Solana RPC, and uploaded them to an external server.

Phase	Timing / Timeframe	Abused Elements / Targets	Confirmed Behavior / Scope
Initial Key Theft	October 2025	Malicious extension color-picker-universal 2.8.91 on developer's personal Mac	Theft of GitHub authentication keys (no compromise of source code or the build chain itself)
Asset Replacement	October 19, 2026, 14:47–16:21 (UTC+2)	OVHcloud CLI v0.11.0 to v0.15.0 (Darwin / Linux / Windows x86_64, etc.)	Replacement of mutable release assets with malicious binaries (~250 downloads)
Collection & Exfiltration	Upon execution of tampered binary	Temporary directory envchecker-[0-9]{9,10}, Solana RPC, 45.32.148[.]174:443	Archiving and external exfiltration of cloud, SSH, and AI tool secrets (actual number of victims unannounced)

4. Attacker Position and Execution Location

• GlassWorm-associated threat actors holding stolen GitHub developer keys
• Developer account with permissions to modify release assets in the OVHcloud repository
• External exfiltration infrastructure (45.32.148[.]174, etc.) receiving secret archives from infected devices

5. Victim and Administrator Perspective

Victims

• While the CLI appears to function like a standard management tool, secrets are collected in the background upon execution.
• On affected devices, simply deleting the binary is insufficient; cascading credential rotation across cloud, source code management, cluster, and SSH accounts is required.

Administrators and SOCs

• Inference: Review available GitHub audit logs for release asset deletion and re-upload history, and check for the creation of envchecker-* directories combined with external network traffic logs on endpoints. Because this depends on log collection settings and retention periods, the absence of records cannot be treated as proof of no compromise.
• On the cloud side, identical credentials leaked from endpoints may appear as subsequent usage originating from unknown sources.

6. Success and Failure Conditions

Success Conditions

• Downloading a tampered release asset during the affected window (October 19, 2026, 14:47–16:21 UTC+2) and executing the binary (this applies even if execution occurs after the distribution window).
• Readable developer and cloud secrets existing on the execution device.
• Outbound network traffic (egress) permitted from the device to Solana RPC endpoints and external exfiltration destination IPs.

Failure Conditions and Mitigations

• Do not execute suspicious binaries; verify them against the malicious hashes and temporary envchecker directories listed in the official advisory, then delete them and switch to clean version v0.16.0 or later. However, replacing the binary alone does not remediate already leaked credentials or existing subsequent compromises.
• Revoke and reissue (rotate) all target secrets that existed on the device and investigate audit logs on each cloud service provider's side.
• Inference: Maintainers should implement release immutability and provenance verification (such as signatures), while users should verify checksums and attestations using independent and trusted standards. Signed tags alone do not guarantee the contents of mutable release assets.

7. What Happens Upon Success

• Theft of cloud and developer secrets for AWS, GCP, Azure, Kubernetes, Docker, SSH, and Terraform, as well as AI coding tool session data and histories.
• Abuse of official release channel trust and potential secondary compromise of downstream environments using stolen credentials (subsequent abuse of individual credentials remains unconfirmed at this time).
• Although approximately 250 downloads occurred during the affected window, the number of successful executions and successful external exfiltrations has not been publicly disclosed.

8. Observable Logs

Inference: The following items are candidates for internal investigation. Availability depends on products, permissions, logging configurations, and retention periods, and individual suspicious operations or missing logs do not conclusively prove attribution or compromise.

Email

• Check for security notifications from OVHcloud and GitHub, as well as unauthorized usage alerts from cloud providers.

Proxy / SWG / DNS

• Monitor for outbound traffic to Solana RPC endpoints and 45.32.148[.]174:443. Because destinations can be dynamically updated via Solana, the absence of connections to known IPs does not rule out external exfiltration.

Endpoint / EDR

• Monitor for the creation of temporary directory envchecker-[0-9]{9,10} immediately following execution of the ovhcloud binary, the enumeration of various credential files, and archiving behavior.

Identity / IdP

• Check for usage of GitHub tokens, cloud API keys, SSH keys, and service accounts originating from unknown sources.

SaaS / Cloud

• Cross-correlate audit logs across AWS, GCP, Azure, Kubernetes, and GitHub from October 19, 2026, onward.

Network

• Check for outbound traffic originating from the official CLI process toward Solana RPC endpoints or external exfiltration destination IPs.

9. Attack Success Determination

• Malicious distribution, collection, and exfiltration capabilities confirmed / Success of theft per endpoint unconfirmed
• Basis: Publicly, OVHcloud confirmed the distribution of tampered binaries, approximately 250 downloads, and the sample's collection and exfiltration capabilities. However, the number of endpoints on which execution or exfiltration succeeded, and the number of subsequent misuse cases, have not been disclosed.
• Scope: The download count of approximately 250 does not represent the number of successful executions, exfiltrations, or subsequent abuses.

10. Investigation Playbook

• Trigger: Identify traces of envchecker-[0-9]{9,10} directory creation immediately following ovhcloud binary execution, credential file enumeration, and archive creation.
• Initial Verification: Normalize target assets, accounts, and event times into UTC/JST and preserve related logs.
• Endpoint / Server Investigation: Inference: Review available GitHub audit logs to verify release asset deletion and uploads, and cross-reference envchecker-* directories with outbound traffic on endpoints. Due to dependencies on log settings and retention periods, the lack of records does not prove the absence of compromise.
• Authentication / Cloud Investigation: Check for unusual origin usage of GitHub tokens, cloud keys, SSH keys, and service accounts.
• Subsequent Actions: Track whether secrets for AWS, GCP, Azure, Kubernetes, Docker, SSH, Terraform, AI tool sessions, etc., were stolen and utilized secondarily.
• Containment: Do not execute suspicious binaries; cross-reference them against official malicious hashes and temporary envchecker directories for deletion, and replace them with v0.16.0 or later. Because replacement alone does not resolve leaked credentials or existing subsequent compromises, revoke and reissue secrets concurrently.
• Determination Categories: Clearly separate stages such as contact (download), execution, authentication success, data collection, and subsequent compromise, avoiding premature assumptions of unconfirmed success.

11. Defense and Detection Ideas

• Single Events: Detect the creation of envchecker-[0-9]{9,10}, credential file enumeration, and archive creation immediately following ovhcloud binary execution.
• Timeline Correlation: Correlate events chronologically, considering the sequence from the initial GitHub key theft in October 2025 via a malicious extension on a developer's personal Mac -> abuse of developer privileges and mutable releases to replace v0.11.0–0.15.0 assets with malicious binaries -> download and execution by users from official GitHub releases -> collection and archiving of secrets into temporary directories by envchecker, destination lookup via Solana RPC, and archive upload to the external exfiltration destination. Organizations should correlate binary acquisition and execution with file enumeration and outbound traffic.
• Threat Hunting: Search for outbound traffic from the official CLI process to Solana RPC endpoints or external exfiltration destination IPs (such as 45.32.148[.]174).
• Log Limitations: The approximately 250 downloads do not represent unique endpoint counts or successful thefts. Confirming execution and exfiltration requires evidence from both endpoints and network traffic, and log availability depends on configuration and retention periods.
• Priority Mitigations: Do not execute suspicious binaries; cross-reference them against official malicious hashes and temporary envchecker directories for deletion and update to v0.16.0 or later (replacement alone does not resolve leaked credentials or subsequent compromises). Revoke and reissue all target secrets and investigate provider-side logs. Inference: Maintainers should ensure release immutability and signature/provenance verification, while users should verify checksums and attestations using independent, trusted standards (signed tags alone do not guarantee the contents of mutable release assets).

12. Facts, Inference, and Hypothesis

Facts

• Between 14:47 and 16:21 (UTC+2) on October 19, 2026, release binaries for OVHcloud CLI v0.11.0 to v0.15.0 were replaced, resulting in approximately 250 downloads.
• Affected release assets include Darwin and Linux builds and the Windows x86_64 build downloaded during that timeframe. Executing a tampered binary is within scope even after the distribution window; the source code, tags, and build chain were not affected.
• The malware creates an envchecker directory in temporary storage and collects AI coding tool databases and histories, AWS, GCP, Azure, Docker, Kubernetes, npm, DigitalOcean, SSH, Terraform, .netrc, and git configuration files.
• It retrieves dynamic control information from Solana RPC and uploads collected archives to 45.32.148[.]174.
• The root cause was key theft by a malicious extension (color-picker-universal 2.8.91) installed on a developer's personal Mac in October 2025, combined with disabled release immutability on GitHub Releases.
• Clean version v0.16.0 was published with signed tags and immutable releases enabled.

Inference

• Even if source code and Git tags are legitimate, mutable release assets can be replaced later, requiring independent verification of checksums, attestations, and immutable releases.
• Because the collected items span multiple categories, compromise of a single developer device can spread to secondary compromises across multiple clouds, CI/CD pipelines, and source repositories.

Hypothesis

No additional hypotheses. Unverified items are documented under "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1195.002	Supply Chain Compromise: Compromise Software Supply Chain	high	OVHcloud confirmed official release binary replacement, distinct from per-endpoint execution success counts. Definition
T1552.001	Unsecured Credentials: Credentials In Files	high	Official analysis describes sample capabilities to collect credential files such as cloud configurations and SSH keys. Definition
T1005	Data from Local System	high	Official analysis lists local files such as development tool databases and histories as collection targets. Definition
T1560	Archive Collected Data	high	The sample archives the collection directory. Because distinction of specific utilities/libraries is unconfirmed, it is limited to the parent technique. Definition

14. Unknowns and Additional Investigation

• Out of approximately 250 downloads, the exact number of endpoints where the binary was actually executed
• The number of victims whose collected archives were successfully exfiltrated externally
• The presence, absence, and scope of subsequent abuse using stolen secrets
• The full activity history spanning from the developer key theft in October 2025 to the release tampering in October 2026
• Because it remains unconfirmed whether external exfiltration uses the same channel as existing command-and-control communications, mapping to T1041 (Exfiltration Over C2 Channel) is withheld.

15. Impact on SOCs and Organizations

For endpoints that downloaded the tampered CLI during the affected window and executed it at any later time, do not conclude remediation solely by deleting the binary or updating. Rotate all secrets present on those devices—such as cloud, SSH, Kubernetes, GitHub, and AI tools—and verify downstream cloud and SaaS audit logs for unauthorized activity.

16. Summary by Role

• For SOCs: Check for outbound traffic from the official CLI process to Solana RPC endpoints or external exfiltration destination IPs, and investigate traces of envchecker-[0-9]{9,10} directory creation, credential file enumeration, and archive creation immediately following ovhcloud binary execution.
• For Administrators: Do not execute suspicious binaries; cross-reference them against official malicious hashes and temporary envchecker directories for deletion, and replace them with v0.16.0 or later. Because replacement alone does not resolve leaked credentials or existing subsequent compromises, a comprehensive revocation and reissuance of target secrets is required.
• For Users: If you encounter suspicious notifications, errors, or authentication requests, do not retry the operation on your own; contact an administrator promptly.