Summary
- OVHcloud says attackers substituted CLI release assets across versions 0.11.0 to 0.15.0; a reporter directly verified changed assets for three versions.
- A mismatched checksum exposed altered downloads on 19 October, after which the provider removed them and released version 0.16.0.
- Downloading and executing an affected binary could expose locally accessible secrets; the number of affected customers remains unconfirmed.
French cloud provider OVHcloud has confirmed the compromise of downloadable release files for its command-line utility after an attacker used a developer’s GitHub account to distribute altered binaries capable of collecting secrets from local systems. The company identified versions 0.11.0 through 0.15.0 as affected, removed the substituted files and released version 0.16.0 as a clean replacement.
The discrepancy emerged on 19 October during an automated build, when a user found that the SHA-256 checksum of a Linux ARM64 archive no longer matched the value previously recorded by its continuous integration system. Inspection of the GitHub release page showed that assets attached to established version tags had been uploaded again weeks after those releases were originally published. The earliest confirmed changed upload was recorded at 12:47 UTC, and the version labels did not warn users that the executables underneath them had changed.
The reporter directly compared replaced assets for versions 0.13.0, 0.14.0 and 0.15.0; the wider five-version scope comes from OVHcloud’s subsequent notice. In one example, an altered Linux binary presented itself as a locally modified build from a later source commit, rather than the source revision associated with its release label. Its build information also differed from the project’s established release configuration. Those observations establish the substitution independently of the company’s wider assessment of affected versions.
OVHcloud CLI gives administrators and developers a terminal-based way to manage the provider’s infrastructure and services. Such utilities are often installed on workstations or automation systems that also contain cloud credentials, access tokens and configuration files. A malicious executable delivered through the expected download channel can therefore encounter sensitive material without requiring an attacker first to compromise the cloud service itself. The confirmed warning concerns the distribution of the CLI; it is not evidence that OVHcloud’s core hosting infrastructure was breached.
After the public report, an OVHcloud maintainer acknowledged the problem and confirmed that the replaced assets had been deleted by 16:21 Central European Summer Time on 19 October. The maintainer subsequently announced version 0.16.0, describing its signed release tag and immutable assets as safeguards for the replacement download. On 20 October, the project’s maintainers linked a more detailed GitHub security advisory and said they had enabled private vulnerability reporting.
The exposure is therefore conditional on both acquisition and execution. A customer who retained an authentic executable obtained before the replacement would not have installed the substituted asset merely by using an affected version number. A developer or automation system that downloaded a changed archive during the attack window and ran it, however, could have exposed secrets accessible to that process. OVHcloud’s warning does not establish how many customers downloaded or executed a malicious file, or which credentials, if any, were ultimately obtained.
The attack exploited a separation between the source repository and the software distributed from it. An unchanged Git tag does not by itself attest that the attached binary is identical to the one first issued under that tag. The attacker also replaced the published checksum list. The reporting user detected the change because its build process retained an earlier hash, independent of the currently available checksum file. Routine automation trusting both freshly downloaded files might not have detected the substitution.
The company’s affected-version notice gives administrators a basis for checking downloaded archives and automation records against the period of exposure. Where execution of a substituted binary is established, replacing potentially exposed credentials is a different task from installing version 0.16.0: a newly downloaded clean executable cannot undo secrets already collected by malware. Conversely, an affected release label without evidence of a malicious download should not be reported as a confirmed credential theft.
OVHcloud says the replacement release has a signed tag and immutable assets. Those measures reduce the opportunity for later file substitution, although verification still depends on how release signatures, provenance and downloaded hashes are checked in customer environments. The developer account compromise also makes control of publishing credentials part of the software distribution risk, separate from protections on the cloud infrastructure managed by the tool.
The maintainers have promised a post-mortem addressing the intrusion and response. As of the 20 October updates, their public record confirmed substituted downloads, deletion of the affected assets, and issuance of version 0.16.0. The route by which publishing credentials were compromised and any verified downstream customer compromises remain matters for further disclosure.
