OVHcloud CLI (ovhcloud-cli) GitHub release binaries v0.11.0-v0.15.0 replaced with a secret stealer on October 19, 2026: did I download one, and what should I rotate?

What happened: on October 19, 2026 an attacker used a hijacked OVHcloud developer GitHub account to replace the downloadable release files of the official OVHcloud CLI, versions 0.11.0 to 0.15.0, with locally built malicious binaries. The tags and version numbers didn't change, only the files under them. The malicious files were live for about 94 minutes (roughly 12:47 to 14:21 UTC; OVHcloud reported 14:47-16:21 in UTC+2) and were downloaded about 250 times. They searched the machine for secrets such as cloud credentials, SSH keys, Docker configuration and Kubernetes credentials. A customer's CI pipeline with a pinned checksum caught the change. OVHcloud says its source code and build pipeline were not compromised; it published a clean 0.16.0 and turned on immutable releases. Am I affected: - You (or a CI job, Dockerfile or install script) downloaded an ovhcloud-cli release asset for 0.11.0-0.15.0 from GitHub Releases on October 19, 2026 during that window. Downloads before or after the window got the legitimate files. - Check CI logs and build caches for downloads that day, compare the SHA-256 of any cached binary against the checksums OVHcloud publishes for the legitimate releases, and check whether builds that day used a 'latest' download URL. Fix: 1. Replace the CLI with 0.16.0 or later from the official release page, and verify its checksum. 2. If a machine or runner ran an affected download: treat it as compromised. Rotate OVHcloud API credentials (application keys and consumer keys), cloud provider keys, SSH keys, Docker registry logins, Kubernetes kubeconfigs and tokens, and anything in environment variables or files on that machine. Rebuild ephemeral CI runners and clean persistent ones. 3. Review OVHcloud account activity and other cloud audit logs from October 19 onward for actions you didn't make. After: pin downloaded binaries by checksum (as the customer who caught this did), prefer package managers or signed releases where available, and avoid unpinned 'latest' downloads in CI. Sources: https://www.it-connect.fr/ovhcloud-cli-binaires-pieges-vol-secrets/ https://webhosting.today/2026/10/21/ovhcloud-cli-downloads-carried-a-secret-stealer-for-up-to-94-minutes/ https://securityonline.info/ovhcloud-cli-supply-chain-attack/