OVHcloud CLI tool releases compromised with info-stealing malware
OVHcloud has identified a supply chain attack where unauthorized parties modified five versions of its command-line interface tool hosted on GitHub. The company is urging users to immediately update or delete the affected versions to prevent potential data theft.
Published Oct 22, 2026, 12:06 AM · Last verified Oct 22, 2026, 12:06 AM
What Happened?
Unauthorized actors successfully tampered with specific releases of the OVHcloud command-line interface (CLI) tool hosted on GitHub to distribute information-stealing malware.
Who Was Affected?
Users who downloaded versions v0.11.0 through v0.15.0 of the OVHcloud CLI tool are potentially impacted.
When Did It Happen?
The incident was disclosed on October 21, 2026.
How Did the Attack Happen?
Threat actors compromised the official release distribution on GitHub, replacing legitimate binaries with versions containing malicious code designed to steal information.
What Information Was Compromised?
The specific nature of the stolen data has not been detailed, though the malware is classified as an information stealer.
Who Is Responsible?
The threat actor behind the tampering is not yet identified.
Current Investigation and Response?
OVHcloud CEO Octave Klaba confirmed the incident and issued an urgent alert to customers. The company has released a safe version (v0.16.0) and instructed users to update or remove the compromised software immediately.
What Organizations and Individuals Can Learn?
Organizations maintaining open-source tools should implement rigorous integrity checks for release pipelines. Users should verify software checksums and prioritize updating tools immediately when security alerts are issued.
Key takeaways
- Five versions of the OVHcloud CLI tool (v0.11.0 to v0.15.0) were compromised.
- The attack represents a supply chain incident involving unauthorized code injection into official releases.
- OVHcloud has advised users to update to version v0.16.0 or delete the affected software.
Protection recommendations
- Verify the integrity of downloaded software using official checksums or signatures.
- Immediately update software when a developer issues a security alert regarding a compromised version.
- Implement automated security scanning for software release pipelines.
Incident timeline
Oct 21, 2026
First reported by Help Net Security
Sources
- Info-stealing malware slipped into OVHcloud CLI releases on GitHub · Help Net Security
This report was drafted with AI from the headline and excerpt of the sources above and reviewed by an editor. See our AI disclosure and corrections policy. Based on the headline and excerpt published by Help Net Security.