GlassWorm Slips a Secret Stealer Into Five OVHcloud CLI Releases
An attacker used a hijacked developer account to swap the binaries on five OVHcloud CLI releases for a build that steals cloud keys, SSH keys and AI-tool data. OVHcloud ties it to GlassWorm and says about 250 downloads happened in the 94-minute window.
For about 94 minutes on Oct. 19, anyone who downloaded the official OVHcloud command-line tool from GitHub could have received a build that hunts for secrets on disk and ships them out. According to OVHcloud’s advisory, an attacker used a developer’s hijacked GitHub account to swap the binaries on five existing releases, v0.11.0 through v0.15.0. Researchers at OpenSourceMalware reconstructed the attack and tie it to the GlassWorm campaign. OVHcloud makes the same link, and it found the developer’s personal MacBook had been infected through an extension called color-picker-universal.
For defenders
Affected: v0.11.0 to v0.15.0 for Darwin arm64/x86_64, Linux arm64/x86_64 and Windows x86_64, downloaded between 12:47 and 14:21 UTC on Oct. 19, according to the advisory (GHSA-862f-55f5-vmvw, severity High, no CVE). OpenSourceMalware says checksums.txt was replaced last, so the published hashes matched the bad files. Installs through install.sh, the Homebrew cask, direct downloads or CI jobs pulling the tarball were exposed. go install, source builds and the Docker image were not, per the researchers. Fixed: v0.16.0, signed and published as an immutable release.
Behavior: OVHcloud says the trojanized CLI carries an added “envchecker” module that collects AWS, Google Cloud, Azure, DigitalOcean and Terraform credentials, Docker and Kubernetes configs, ~/.ssh, ~/.netrc, npm config, ~/.gitconfig, and data from VS Code, Cursor, Continue, Cody, OpenCode and ~/.claude. It archives the haul and uploads it to a server whose address is looked up through Solana RPC calls. The staging folder is never deleted, so it doubles as evidence. A customer’s CI job caught the swap when a pinned SHA-256 failed. Relevant techniques: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), T1078 (Valid Accounts), T1552.001 (Unsecured Credentials: Credentials In Files), T1102.001 (Web Service: Dead Drop Resolver).
45.32.148[.]174:443 (exfil, path /upload)
162.33.177[.]177 (root-cause infection)
Solana wallet BHaDaVbdCYFNaKZGn7yLXFneWoJHZgLiBYkHxVrjyALF (exfil)
Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (dead drop)6f2f086239f3d88eb2750e871901927d (Darwin_arm64)
347e65eb7f2d78d1c6872690272a6cc3 (Darwin_x86_64)
01f57206d37c28cf711677f612052913 (Linux_arm64)
301bff0b51980b9e76c93633e7cfd3bd (Linux_x86_64)
6a3cf153338c416169cda2fe704c8848 (Windows x86_64)Temp folder named envchecker- followed by 9-10 digits
~/init.json (macOS loader throttle file, per OpenSourceMalware)What it means for you
This one matters only if you use OVHcloud’s ovhcloud CLI, a tool developers use to manage OVHcloud services from a terminal. If you downloaded or updated it during the window, assume everything stored on that computer is in someone else’s hands: cloud logins, SSH keys, saved tokens, even data from coding assistants. OVHcloud puts downloads at roughly 250. If you’ve never installed this tool, there’s nothing to do.
Do this now
- Check whether you pulled the CLI on Oct. 19, then compare your binary’s MD5 against the list above. Don’t run it to find out.
- If it matches, or you find an
envchecker-folder in your temp directory, rotate every secret that machine could read, working from a different, clean computer. - Delete the old binary and install v0.16.0 or later. OpenSourceMalware suggests checking it with
gh attestation verify. - Pin release hashes in CI, and flag outbound Solana RPC traffic from build hosts that have no business making it.