What happened

On 19 October 2026, the binaries attached to five existing releases of OVHcloud's official command-line tool were replaced with a credential stealer, according to StepSecurity. The swapped files covered v0.11.0 through v0.15.0 of ovh/ovhcloud-cli, stayed up from 12:47 to 14:21 UTC and were downloaded about 250 times. The uploads came through the account of an OVHcloud contributor, while the tags, the CI workflows and the source code were left untouched.

The uploader also replaced checksums.txt so the published hashes matched the new files, and the install script does not check hashes at all. A customer whose CI pinned the hash of the Linux arm64 archive caught the swap, and OVHcloud then removed the files and released a clean, attested v0.16.0. StepSecurity says Homebrew, go install, source builds and the Docker image were not exposed.

Per OVHcloud's postmortem, cited by StepSecurity, the contributor's personal MacBook picked up a malicious VS Code extension, color-picker-universal 2.8.91, in October 2025, and the uploads used stolen keys. According to the advisory, the stealer gathers AI agent credential stores, cloud and container credentials, SSH keys, .netrc and .gitconfig, stages them under /tmp/envchecker-* and sends an archive to 45.32.148.174.

Timeline

  1. The first swapped files appear on v0.15.0.[1]

  2. A customer reports the swap after a pinned-hash CI check fails.[1]

  3. OVHcloud removes all the swapped files.[1]

  4. OVHcloud publishes a clean, attested v0.16.0.[1]

Who is affected

  • Anyone who downloaded or ran an ovhcloud binary from the project's GitHub releases between 12:47 and 14:21 UTC on 19 October 2026.
  • Homebrew, go install, source builds and the Docker image were not exposed.

How to check

  1. Run ovhcloud version; a version of undefined shown with commit 5ead8ef marks the malicious build.
  2. Look for /tmp/envchecker-* directories, which the stealer creates and never removes.
  3. In CI, review jobs that downloaded v0.11.0 to v0.15.0 release files between 12:47 and 14:21 UTC on 19 October, and treat credentials those runners could reach as exposed.

What to do

  1. Treat any machine that ran a swapped binary as fully compromised and assume its secrets were sent out.
  2. From a different machine, rotate every secret the affected one could read; updating or reinstalling the tool revokes nothing.
  3. Delete the binary and any /tmp/envchecker-* directories, then install v0.16.0 and verify its attestation.
  4. If you cannot show the machine is clean, rebuild it.

Packages named

Named in the source, not checked: this brief has a single source so far. Cloak Watch looks for these once more sources confirm it.

EcosystemPackageVersions
otherovh/ovhcloud-cliv0.11.0v0.12.0v0.13.0v0.14.0v0.15.0

Indicators of compromise

Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.

TypeIndicatorNoteCopy
URLhxxps://45[.]32[.]148[.]174/uploadexfiltration endpoint[1]
File path/tmp/envchecker-*stealer staging directories, never deleted[1]
SHA-2563833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cbmalicious Linux arm64 v0.15.0 archive[1]
MD56f2f086239f3d88eb2750e871901927dmalicious Darwin arm64 binary[1]
MD5347e65eb7f2d78d1c6872690272a6cc3malicious Darwin x86_64 binary[1]
MD501f57206d37c28cf711677f612052913malicious Linux arm64 binary[1]
MD5301bff0b51980b9e76c93633e7cfd3bdmalicious Linux x86_64 binary[1]
IP address162[.]33[.]177[.]1772025 backdoor C2 from color-picker-universal 2.8.91[1]
WalletBjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SCGlassWorm Solana dead-drop wallet[1]

Sources

Changelog

  1. First published.