An attacker hijacked a GitHub contributor account and swapped download archives on five OVHcloud CLI releases for 94 minutes with secret-stealing builds.
Learn how the swap bypassed unsigned paths and how automated hash verification caught it.
The incident occurred on Monday, October 19, and the tampered files remained available on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC. The issue affected anyone who downloaded or updated the tool during that time window on macOS, Linux, or Windows computers using methods that did not verify the digital identity of the files.
Who was affected and what went wrong?
The change affects five previous versions of the program that were released between April and September, specifically versions v0.11.0 to v0.15.0. The older version v0.10.0 was left untouched. The perpetrators did not tamper with the company's source code or program creation systems, but uploaded their own files directly to the download pages.
Those who used the Homebrew package manager were not affected, as Homebrew always checks the digital identity of each file and rejects anything that doesn't match. Also, those who used other installation methods or had previously installed the program and didn't update it during the affected period were safe.
READ ALSO
Siemens fixes security flaw exploited in attacks
How it was revealed and how the company reacted
A customer of the company detected the discrepancy in the files because his system was checking the digital identity and opened a public discussion thread on GitHub at 13:50 UTC. OVHcloud deleted the tampered files at 14:21 and released the clean version v0.16.0 at 17:16 the same day with a signed identity.
OVHcloud founder Octave Klaba said the problem was caused by a security feature that locks published versions so they can't be changed later. That feature has now been enabled. The company did not specify exactly what files the malware was reading, where it was sending them, or how many users downloaded them.
Security researchers from the OpenSourceMalware team linked the compromised account to a malware campaign known as GlassWorm, noting that personal repositories of the same account had received suspicious changes in early March.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)