OVHcloud CLI Hijack Distributes Secret-Stealing Malware

On Monday, October 19, security researchers discovered an attacker had taken control of a contributor’s GitHub account and used it to replace the download archives for five existing releases of OVHcloud’s command‑line interface (CLI) tool. The compromised files were available on GitHub for up to 94 minutes—from 12:47 to 14:21 UTC—before detection by the cloud provider ¹.

Investigators say the new binaries were built to scan the disk of any system that executed them and exfiltrate stored secrets such as API keys or passwords, effectively turning the trusted CLI into a secret‑stealing Trojan. They suspect the malware targets common credential storage patterns in development environments—including environment variables holding AWS credentials, SSH private keys, or database passwords. This mirrors past supply‑chain attacks like SolarWinds Orion, but here attackers leveraged a hijacked contributor’s access token rather than direct build‑system intrusion, similar to the 2017 npm leftpad typo‑scaping incidents but more impactful due to targeting corporate tooling infrastructure.

The attacker likely exploited OAuth tokens or a personal access token from the compromised GitHub account, granting write privileges across the repository. This approach is reminiscent of earlier npm package tampering cases where malicious code was injected into popular libraries, highlighting how trust can be subverted through reputable channels. The 94‑minute window underscores how quickly such breaches propagate before detection mechanisms trigger alerts.

Investigators recommend verifying binary integrity and reviewing dependency management processes when downloading tools from open‑source platforms. They also advise scanning newly acquired tools for anomalous behavior before execution and ensuring strict checksums or signed releases to mitigate future hijacks.

Secret‑stealing malware poses significant risk to cloud environments; by harvesting locally stored credentials, attackers gain footholds that can be leveraged for lateral movement or data exfiltration. It serves as a reminder that supply‑chain security extends beyond build systems—it includes contributor access controls, token rotation policies, and vigilant monitoring of repository activity. Organizations with similar tooling ecosystems should consider implementing multi‑factor authentication for GitHub accounts and limiting write permissions to essential contributors only. Regularly updating and pinning dependencies further reduces exposure to compromised packages.

OVHcloud’s investigation remains ongoing, but the public disclosure signals a broader industry need: secure not just the final product but every step leading to its distribution. As attackers refine techniques to subvert trusted channels, defenders must adopt layered safeguards—from credential hygiene to continuous integrity verification—to protect both codebases and the secrets they may inadvertently expose.