Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Summary: An attacker used a hijacked contributor's GitHub account to replace the download archives on five existing OVHcloud CLI releases on Monday, October 19, with a build designed to steal secrets from the disk of any machine that ran it. The swapped files were live for up to 94 minutes, from 12:47 to 14:21 UTC, and OVHcloud lists v0.11.0 through v0.15.0 as compromised, with v0.10.0 clean.
What you should know: Anyone who installed or updated the CLI on macOS, Linux x86_64 or arm64, or Windows x86_64 during that 94-minute window may be running a binary that reads secrets off disk, and OVHcloud founder Octave Klaba advised affected users to change every secret stored on the machine. The swap worked because release immutability was not enabled, so a single contributor account with write access could overwrite published archives without the CI/CD pipeline ever running.

Read the original at The Hacker News ↗