OVHcloud warns that attackers compromised its open-source command-line interface (CLI) by hijacking a developer’s GitHub account and replacing release files with malware. Researchers say the developer account was compromised in March using infrastructure linked to “GlassWorm,” which later enabled the distribution of a loader and information-stealing payload.
Multiple outlets report that the tampered CLI releases were published on GitHub and designed to steal developer secrets from machines that run the tool. The Hacker News adds detail that five existing OVHcloud CLI releases were altered and notes a timeframe when the backdoored versions were publicly available.
While all sources frame the incident around the hijacked account and the resulting distribution of stealer code, they differ in emphasis: some focus on the developer account compromise and the link to a specific malware group, while others highlight OVHcloud’s disclosure and the GitHub release mechanism used to deliver the backdoored CLI. All coverage centers on the risk to systems running the affected CLI versions and the broader supply-chain nature of the attack.
