OVHcloud is warning that its open-source command-line interface was backdoored on GitHub. Both BleepingComputer and The Hacker News report that an attacker hijacked a contributor's account and replaced the download archives on five releases, v0.11.0 through v0.15.0, with builds designed to steal secrets stored on disk. The malicious files were live from 12:47 to 14:21 UTC on October 19.
The Hacker News adds that exposure depended entirely on the installation method. The official install script, direct archive downloads, CI jobs without pinned hashes, and the CLI's own upgrade command were all vulnerable because they do not verify checksums. Homebrew, go install, source builds, and Docker images were not affected, either because they pinned hashes or pointed to untouched artifacts. The source code, release tags, and build pipeline were not compromised.
A customer spotted the swap by inspecting a binary with go version -m, which showed a pseudo-version and a commit that did not match the release tag. However, The Hacker News cautions that simply seeing +dirty or vcs lines is not a reliable indicator, since OVHcloud's own clean v0.16.0 build shows those too. OVHcloud founder Octave Klaba advised anyone affected to rotate every secret stored on the machine, and OpenSourceMalware recommends doing so from a different device. OVHcloud has not yet disclosed what the malware exfiltrates or how many downloads occurred, and has promised a postmortem.