OVHcloud CLI hit by supply chain attack: malicious binaries planted in v0.11.0–v0.15.0 releases
evilsocket · x · 2026-10-20
OVHcloud's official CLI was compromised in a supply chain attack: a hacker used a developer's GitHub account to replace release assets for v0.13.0–v0.15.0 (affecting versions v0.11.0–v0.15.0) with binaries built to steal secrets.
Per the accompanying GitHub issue, the assets were swapped on 2026-10-19 and discovered only because a user's CI pinned the SHA-256 of ovhcloud-clilinuxarm64.tar.gz and started failing. Go build metadata shows the new "v0.15.0" binary is a dirty build not from the v0.15.0 tag (vcs.modified=true). Linux arm64/x8664, Darwin, and Windows x8664 assets plus checksums.txt were replaced; i386, Windows arm64, and wasm assets were untouched.
Related event: OVHcloud CLI Hit by Supply-Chain Attack Stealing Local Secrets(2 posts)→
More from Infra
- Together, Fireworks, Prime Intellect and Modal are all converging on inference + RL training — NielsRogge · 2026-10-20
- NVIDIA GTC kicks off in Berlin with Jensen Huang keynote set for tomorrow — NVIDIAAI · 2026-10-20
- Hyperdrives CEO interview: cheaper power-dense electric motors via cooling breakthrough — MarvinTBaumann · 2026-10-20
- MiniMax H3 video generation runs on a single RTX 3060 12GB via GGUF quantization — Ok-Inevitable8391 · 2026-10-20
- ByteDance, Alibaba, Tencent place over $35B in Nvidia chip orders amid supply crunch — pstAsiatech · 2026-10-20
- DeepSeek-V4.1-Flash tops Agent Arena open models, ranks #11 overall at $0.20/task — vista8 · 2026-10-20