OVHcloud CLI Supply Chain Compromise: A User Playbook
On 19 October 2026, a supply chain compromise replaced GitHub release binaries of the official OVHcloud CLI (ovhcloud-cli) with a credential stealer for about ninety minutes. Anyone who installed from GitHub, Homebrew, or the project’s install script in that window could have received malware instead of a cloud tool. The source repository was clean. The build pipeline was clean. The files on the release page were not. OpenSourceMalware reconstructed the incident: timeline, how the assets were swapped, how the malicious build was identified, GlassWorm indicators, hashes. OVHcloud published a security advisory the next day, pulled the bad files the same afternoon, and shipped a clean immutable v0.16.0. ...