Attackers compromised a contributor’s GitHub account and replaced files in five OVHcloud command-line tool releases with malware designed to steal secrets from infected machines on October 19. The malicious files remained available for up to 94 minutes before OVHcloud removed them and released a clean version. Users who installed or updated the tool during that window through certain methods may have downloaded the compromised version.
OVHcloud founder Octave Klaba advised affected users to rotate all secrets stored on their systems. The company has since enabled release immutability on GitHub to prevent similar attacks. Researchers linked the compromised account to GlassWorm, a malware campaign that uses hidden Unicode characters and Solana blockchain transactions to distribute malicious code, though they acknowledged this connection as inference rather than confirmed fact.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
