On 2026-10-19, the official OVHcloud CLI tool was compromised by the Glassworm threat actors who published five malicious versions to GitHub and Brew
On 19 October 2026, between 12:47 and 13:12 UTC, an attacker replaced the release binaries of five already-published versions of OVHcloud’s official CLI (ovh/ovhcloud-cli, v0.11.0 to v0.15.0) with a secret-stealing build. The uploads were made through the GitHub account HassenBF, a legitimate OVH contributor, using the ordinary GitHub Releases API. No tag was pushed and no GitHub Actions workflow ran. The malicious binary was a go build from a workstation with uncommitted changes, dropped straight onto existing releases. A downstream user whose CI pinned a SHA-256 caught it within 94 minutes. OVHcloud deleted the files at 14:21 UTC and shipped a clean, immutable v0.16.0 about three hours later.
The HassenBF account was already compromised and had been for seven months. Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden preinstall.js loader that decodes to a second stage using a Solana memo dead drop. The wallet is a known GlassWorm indicator, and the amend-and-force-push technique matches the ForceMemo campaign. The earliest server-verified use of the account by the attacker is 5 March 2026, about 228 days before the asset replacement. Whether the same actor did both is our inference, and we cover its limits below.
This is a release-asset replacement attack. The source repository was never touched, so anyone verifying against the Go module proxy or building from source was fine. But anyone who ran install.sh, brew install --cask ovh/tap/ovhcloud-cli, or downloaded a tarball from GitHub in that window on macOS, Linux x86_64/arm64 or Windows x86_64 got the malware.
We built the timeline from server-side GitHub data (the repository Activity API, Actions run records and release records), not from git author, committer or tagger dates, which the pusher controls. OVHcloud deleted the replaced binaries before anyone archived them, so we have not analyzed the payload, and we could not independently confirm the 12:47 to 13:12 replacement times. Those come from the reporter’s capture in issue #300. The link between the March account compromise and the October asset replacement rests on the shared account identity, not on anything we observed directly. We found no PolinRider markers, no malicious workflow additions and no GhostAction indicators. The affected versions come from OVHcloud’s statements and the public issue, which lists v0.13.0 to v0.15.0. Release timestamps and the assets left behind show v0.11.0 and v0.12.0 were also touched.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: opensourcemalware.com.
