French cloud services provider OVHcloud recently reported a security breach involving the GitHub account of one of its developers. This breach allowed a hacker to implant a secret-extracting binary into the company’s official command-line interface (CLI) tool. The incident has raised significant concerns regarding the security of software supply chains.
Details of the Security Breach
The breach occurred on October 19, affecting CLI versions from v0.11.0 to v0.15.0. According to OVHcloud, versions 0.10.0 and the newly released 0.16.0 remain unaffected. Founder Octave Klaba noted that the compromised version was detected and blocked within a short period after a customer flagged the issue. The discovery was made on GitHub when an automated hash check failed, leading to public disclosure.
Technical Insights and Response
Klaba explained that the hacker exploited the GitHub account to insert a binary designed to extract confidential information from systems. Although the binary’s quality was deemed poor, it still posed a substantial threat. Crucially, the CI/CD pipelines remained secure, as the problem stemmed from a disabled immutability option on GitHub, which has since been rectified.
OpenSourceMalware reported that the attacker replaced original release files with malicious binaries, targeting prevalent platforms to harvest credentials from developers’ systems. The compromised account had shown signs of unauthorized activity since March 2026, with several repositories altered.
Unanswered Questions and Impact
While links to the GlassWorm group were suggested, OVHcloud has not officially confirmed this connection. Attempts to analyze the payload were unsuccessful, as the malicious files were removed before samples could be obtained. Users who updated the CLI on specific platforms during the attack window may be affected, whereas those using other installation methods remain safe.
The breach highlights vulnerabilities in relying on third-party platforms for software distribution and underscores the importance of implementing stringent security checks. As OVHcloud continues its investigation, the incident serves as a critical reminder of the potential risks associated with supply chain attacks.
For more on this story and related security news, stay tuned to our updates.
