GlassWorm Slips a Secret Stealer Into Five OVHcloud CLI Releases

For about 94 minutes on Oct. 19, anyone who downloaded the official OVHcloud command-line tool from GitHub could have received a build that hunts for secrets on disk and ships them out. According to OVHcloud’s advisory, an attacker used a developer’s hijacked GitHub account to swap the binaries on five existing releases, v0.11.0 through v0.15.0. Researchers at OpenSourceMalware reconstructed the attack and tie it to the GlassWorm campaign. OVHcloud makes the same link, and it found the developer’s personal MacBook had been infected through an extension called color-picker-universal.

45.32.148[.]174:443 (exfil, path /upload)
162.33.177[.]177 (root-cause infection)
Solana wallet BHaDaVbdCYFNaKZGn7yLXFneWoJHZgLiBYkHxVrjyALF (exfil)
Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (dead drop)

6f2f086239f3d88eb2750e871901927d (Darwin_arm64)
347e65eb7f2d78d1c6872690272a6cc3 (Darwin_x86_64)
01f57206d37c28cf711677f612052913 (Linux_arm64)
301bff0b51980b9e76c93633e7cfd3bd (Linux_x86_64)
6a3cf153338c416169cda2fe704c8848 (Windows x86_64)

Temp folder named envchecker- followed by 9-10 digits
~/init.json (macOS loader throttle file, per OpenSourceMalware)

Source article: Glassworm Hacks OVH Clouds CLI tool
Publisher: OpenSourceMalware (@6mile)
Published: Oct. 19, 2026 (the page byline shows Oct. 20)
URL: https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool

Executive Summary

The actor is GlassWorm, the self-spreading developer-tooling campaign OVHcloud and OpenSourceMalware both link to this incident through a shared Solana wallet (BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC) that also appears in public GlassWorm indicator lists; no other vendor alias is used in the sources, and OpenSourceMalware found no PolinRider or GhostAction markers. The campaign reaches well beyond OVHcloud: it spreads through malicious IDE extensions and force-pushed npm preinstall loaders in developers’ personal repositories, and uses blockchain transactions to tell victims where to fetch their next payload. Here, a developer’s personal MacBook was infected in October 2025 by the IDE extension color-picker-universal 2.8.91, which registered a persistent Node.js launch agent talking to 162.33.177[.]177; in March 2026 the same account (HassenBF) force-pushed a variation-selector-obfuscated preinstall.js loader into several of its own repositories. On Oct. 19, 2026, between 12:47 and 14:21 UTC, the attacker used the stolen credentials to replace the Darwin, Linux and Windows x86_64 binaries and checksums.txt on five existing ovhcloud-cli releases (v0.11.0 to v0.15.0) with a dirty local build that embeds an “envchecker” stealer. That stealer copies cloud, container, SSH, Git, npm and AI-assistant credentials and histories into an envchecker-<digits> temp folder, archives it, picks one of five public Solana RPC endpoints to make wallet calls, and uploads the archive to hxxps://45.32.148[.]174/upload. The objective is theft of developer and cloud secrets at scale for follow-on supply-chain access; OVHcloud counts roughly 250 downloads in the 94-minute window, and a downstream CI job’s pinned SHA-256 is what caught it. Hunt leads, false-positive expectations, the absence of published rules, and the indicators are detailed below.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Collection → Command and Control → Exfiltration

Hunt Lead Grid

GlassWorm Exfil and C2 Infrastructure Sweep

OVHcloud’s analysis of the trojanized CLI shows the envchecker stealer uploading its archive over HTTPS to hxxps://45.32.148[.]174/upload on port 443, an IP literal with no hostname, and the root-cause infection on the developer’s MacBook running a Node.js service that talked to 162.33.177[.]177. The stealer ran each time the CLI was executed, so a victim who used an affected build several times would have made several uploads, starting from Oct. 19, 2026 at 12:47 UTC. The detection logic is a retrospective sweep of firewall, proxy and EDR network-connection logs for any connection to either IP, with any HTTPS request to 45.32.148[.]174 on the path /upload treated as confirmed exfiltration, and the requesting process name recorded (expect ovhcloud or ovhcloud.exe for the exfil IP, and node for the launch-agent IP).

Use egress firewall or NetFlow for the IP match, EDR network events to attribute it to a process, and proxy logs where developer traffic is forced through one. Sweep from Oct. 19, 2026 forward for 45.32.148[.]174, and back to October 2025 for 162.33.177[.]177, since the root-cause launch agent was installed on 2025-10-20 and ran persistently. Scope to developer laptops, CI runners and any host where the OVHcloud CLI is installed, including containers and Dockerfiles that fetch from the GitHub releases URL. OVHcloud warns the exfil URL can change at any time, so a clean result does not clear a host that ran an affected build; pair it with the binary and staging-folder sweep. Any hit means that host’s secrets are gone: escalate to incident response and rotate from a different machine rather than tuning.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Exfiltration → T1041 (Exfiltration Over C2 Channel); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (our mapping; neither source publishes ATT&CK IDs)

Sources: “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source); “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware, Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article)

Trojanized ovhcloud Binary and envchecker Staging Folder Sweep

The replacement binaries were built with a plain go build from commit 5ead8ef9b43d (merged Oct. 13) with uncommitted changes, so go version -m on a bad binary shows the module version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, vcs.revision=5ead8ef9b43d354dfb5caadff803b11afc8c5c58, vcs.modified=true and -ldflags="-s -w", while official GoReleaser builds use -trimpath, carry no vcs lines and print the tag from ovhcloud version. OVHcloud gives the Go BuildID yVpy6qnBltxK_IIj7fgu/7gK7p-mDBQlaejq5604n/ETlunjCgU_pmpVsKcw8z/GX18nXeCYAIFTKWPQS3F for its Linux sample. On every run, the stealer creates a folder in the system temp directory named envchecker- followed by nine or ten digits, copies harvested files into it and never deletes it. The detection logic is a fleet-wide file sweep for any ovhcloud or ovhcloud.exe whose MD5 matches the appendix, for the +dirty pseudo-version or the 5ead8ef revision in the binary’s embedded build info, and for any directory matching envchecker-[0-9]{9,10} under /tmp, $TMPDIR (macOS /var/folders/…/T/) or %TEMP%.

Use EDR file inventory or a live-response query across macOS, Linux and Windows developer endpoints, plus a scan of CI runner images, build caches and container layers that may have baked in the CLI. Sweep the current state of disk, not a time window, because the staging folder persists until someone deletes it and is the best evidence that the stealer actually ran. Do not execute a suspect binary to check its version; read the build info with go version -m or hash it. Hash-blocking alone is the wrong control because the five MD5s only cover this one wave and the actor can rebuild at will; the build-metadata and folder-name checks generalize better. A matching binary without a staging folder means it was downloaded but maybe never run, which is still grounds to rotate secrets; a staging folder is a confirmed compromise and should go straight to incident response, with the folder preserved because it lists exactly what was taken.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain); Collection → T1074.001 (Data Staged: Local Data Staging) (our mapping)

Sources: “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware, Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article); “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source)

Solana RPC Dead-Drop Lookups From Developer and Build Hosts

GlassWorm hides its control channel in the Solana blockchain. The March 2026 preinstall.js loader queries public Solana RPC endpoints for the latest transaction of wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and reads a base64 link from the memo field, so the payload URL can change without touching any repository; the October envchecker stealer picks one of five endpoints at random (solana.drpc[.]org, solana-rpc.publicnode[.]com, solana.api.pocket[.]network, api.mainnet-beta.solana[.]com, solana.api.onfinality[.]io/public) and makes calls involving wallet BHaDaVbdCYFNaKZGn7yLXFneWoJHZgLiBYkHxVrjyALF before uploading. The detection logic is a DNS and proxy rule that flags resolution of or connection to any of these five hostnames from a host or process with no crypto role, raised to high severity when the request body (visible with TLS inspection) contains either wallet address or a getSignaturesForAddress-style call, or when the lookup is followed within minutes by an outbound connection to an IP literal.

Use DNS resolver logs as the broad net, proxy logs with TLS inspection for body matching, and EDR network events to tie the lookup to a process such as node, ovhcloud or an editor helper. Sweep back to October 2025 to cover the extension era, then run it continuously. Scope to CI runners, build servers and developer endpoints outside any Web3 team; for Web3 teams, allowlist by the signed binary path of their wallet and test tooling, not by process name, because GlassWorm runs under ordinary node. Blocking the RPC hostnames outright is a sound control on build hosts but the wrong choice for teams that use Solana legitimately, so prefer the per-role scope there. A hit from a CI runner or a cloud CLI should be escalated immediately; the technique generalizes to other blockchain dead-drop malware (EtherHiding-style loaders), so keep the rule even after this wave fades.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1102.001 (Web Service: Dead Drop Resolver) (our mapping)

Sources: “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware, Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article); “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source)

color-picker-universal Extension and Node Launch Agent

The root cause, per OVHcloud, is the IDE extension color-picker-universal version 2.8.91, installed on the developer’s personal MacBook on 2025-10-20. It made RPC calls to the GlassWorm wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and registered a persistent Node.js service through a launchd plist that communicated with 162.33.177[.]177; the stolen credentials later used to swap the releases came from that infection. The same wallet appears in the account’s March 2026 preinstall.js loader, which decodes Unicode variation-selector characters (U+FE00–U+FE0F and U+E0100–U+E01EF) into bytes, decrypts a second stage with AES-256-CBC, skips Russian-locale systems, and on macOS writes a throttle file at ~/init.json. The detection logic is an endpoint rule with three branches: any installed VS Code, Cursor or other VS Code-compatible extension whose identifier contains color-picker-universal; any new plist in ~/Library/LaunchAgents whose ProgramArguments launch node with a script outside a normal package-manager path; and that node process connecting to an IP literal. A ~/init.json on a macOS developer machine next to such a plist is a strong corroborating artifact.

Use EDR file-create and process telemetry on macOS (plist creation, launchd-spawned node), an extension inventory from ~/.vscode/extensions and ~/.cursor/extensions or the editor’s management console, and network events for the IP. Sweep the full current extension and launch-agent state, and 12 months of history where it exists, because this infection sat quietly for a year before it was used. Scope first to personal and corporate machines of anyone with write access to release repositories or signing keys. Developers run many node-based launch agents, so allowlist by script path under known tool directories rather than excluding node. Removing the extension is not enough: the launch agent persists independently, and every credential the machine held must be treated as stolen, including GitHub tokens and SSH keys used for releases. The extension-inventory branch generalizes to the wider GlassWorm extension set; keep it fed from public indicator lists.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1176.002 (Software Extensions: IDE Extensions) and T1543.001 (Create or Modify System Process: Launch Agent); Defense Evasion → T1027 (Obfuscated Files or Information) for the variation-selector loader; Discovery → T1614.001 (System Location Discovery: System Language Discovery) for the Russian-locale check (our mapping)

Sources: “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source); “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware, Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article)

Credential Store Sweep by a CLI Followed by Upload to a Raw IP

Each run of the trojanized CLI reads a long, fixed list of secret stores: ~/.aws/credentials, ~/.aws/config and ~/.aws/cli/cache; ~/.config/gcloud/credentials.db and access_tokens.db; ~/.azure/msal_token_cache.json and azureProfile.json; ~/.docker/config.json; ~/.kube/config; ~/.config/doctl/config.yaml; ~/.terraform.d/credentials.tfrc.json; ~/.ssh; ~/.netrc; ~/.gitconfig; npm config; and AI-tool data such as VS Code and Cursor state.vscdb, Continue’s index.sqlite, Cody’s chat-history.db, OpenCode’s opencode.db, ~/.hermes and ~/.claude. It copies them into the envchecker staging folder, archives the folder and uploads it to an HTTPS IP literal. The detection logic is a per-process sequence: within a short window (start at five minutes), one process reads credential files belonging to at least three different providers from the list above, writes an archive or many copied files under the temp directory, and then opens an outbound HTTPS connection to an IP address with no prior DNS resolution, or POSTs to a path such as /upload.

This needs EDR file-read (open) telemetry on credential paths, which on macOS and Linux usually means enabling file-access auditing for a defined watch list, joined with EDR network events by process ID. Run it continuously and back-test over the period any affected binary was present. Backup agents, dotfile sync tools and the cloud CLIs themselves will read some of these files, so allowlist by signed image path and expected destination, never by process name, and require the multi-provider spread plus the raw-IP upload before alerting. A CLI named after one cloud provider reading another provider’s credentials is suspicious in itself. Any hit is an incident, not a tuning case: isolate the host and rotate every secret in the read list from a clean machine. The logic generalizes to most developer-targeted stealers, including other GlassWorm, Shai-Hulud-style and fake-package payloads, because they all harvest the same files.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1552.001 (Unsecured Credentials: Credentials In Files); Collection → T1005 (Data from Local System) and T1560 (Archive Collected Data); Exfiltration → T1041 (Exfiltration Over C2 Channel) (our mapping)

Sources: “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source)

Release Asset Replacement on Old Tags by a Human Account

The attacker never pushed malicious source. Using the hijacked HassenBF account, they deleted and re-uploaded binaries on five already-published releases over about 25 minutes (v0.15.0 first at 12:47 UTC, then v0.14.0, v0.13.0, v0.12.0 and v0.11.0), replacing checksums.txt on each so the published hashes matched the bad files, and leaving the i386, Windows arm64 and wasm assets untouched. Legitimate releases in that repository are uploaded by the ovh-cds service account through the release workflow. The same account had earlier force-pushed loader commits into long-idle personal repositories (March 5–6, 2026), a pattern OpenSourceMalware says matches other GlassWorm “forcememo” waves. The detection logic is a GitHub audit-log and webhook rule that flags release asset deletion or upload on any release older than a set age (start at 7 days) by an identity that is not the release automation account, escalated when checksums.txt or a signature file is replaced in the same session, when several tags are touched in sequence, or when the actor recently force-pushed to repositories idle for months (judged by server-side push timestamps, since commit dates can be forged).

Use the GitHub organization audit log (release and asset events, git.push with force flags) streamed to the SIEM, or repository webhooks for release events where the audit log is unavailable. Back-test 12 months, then run continuously across every public repository that ships binaries. Allowlist only named release service accounts and GitHub Apps; human maintainers re-uploading assets should be rare enough to review every time. Enabling immutable releases and release attestations, which OVHcloud did after the incident, removes this path and is a better control than detection alone; disabling a contributor without rotating their tokens and SSH keys is the wrong response, because the credentials were stolen from a personal device. Downstream, consumers get the same protection by pinning SHA-256 values from a source the release account cannot rewrite, exactly how this attack was caught. A hit should be escalated as a possible supply-chain compromise, with the replaced assets preserved for hashing.

Hunt Lead Level: 3 (Elite)

ATT&CK: Initial Access → T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) and T1078 (Valid Accounts); Resource Development → T1608.001 (Stage Capabilities: Upload Malware) (our mapping)

Sources: “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware, Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article); “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source)

Hash Appendix

No published YARA or Sigma rules: neither OpenSourceMalware nor OVHcloud published rule text.

Trojanized ovhcloud-cli binaries (envchecker stealer)

MD5 values come from OVHcloud’s advisory (additional source). Neither source gives per-platform SHA-1 or SHA-256, and AlienVault OTX had no record for the MD5s. The advisory also lists five VirusTotal sample SHA-256 values without saying which platform each is; they are listed below as unmapped. One replaced release archive SHA-256 comes from the source article.

MD5s

6f2f086239f3d88eb2750e871901927d  # ovhcloud (Darwin_arm64) -> replaced release binary, v0.11.0-v0.15.0
347e65eb7f2d78d1c6872690272a6cc3  # ovhcloud (Darwin_x86_64) -> replaced release binary
01f57206d37c28cf711677f612052913  # ovhcloud (Linux_arm64) -> replaced release binary
301bff0b51980b9e76c93633e7cfd3bd  # ovhcloud (Linux_x86_64) -> replaced release binary
6a3cf153338c416169cda2fe704c8848  # ovhcloud.exe (Windows x86_64) -> replaced release binary

SHA1s

(not available)  # ovhcloud / ovhcloud.exe, all five platforms (OTX had no record)

SHA256s

3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb  # v0.15.0 ovhcloud-cli_Linux_arm64.tar.gz -> replaced release archive (source article)
e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4  # trojanized ovhcloud sample, platform not mapped (OVHcloud advisory, VirusTotal sample list)
3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a  # trojanized ovhcloud sample, platform not mapped (OVHcloud advisory, VirusTotal sample list)
3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927  # trojanized ovhcloud sample, platform not mapped (OVHcloud advisory, VirusTotal sample list)
25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec  # trojanized ovhcloud sample, platform not mapped (OVHcloud advisory, VirusTotal sample list)
f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a  # trojanized ovhcloud sample, platform not mapped (OVHcloud advisory, VirusTotal sample list)

GlassWorm preinstall.js loader (HassenBF repositories, March 2026)

SHA-256 values come from the source article; no MD5 or SHA-1 is published, and OTX was not checked for these loader hashes.

MD5s

(not available)  # preinstall.js -> repo root, run by "preinstall": "node preinstall.js"
(not available)  # decrypted stage two (in memory, eval'd)

SHA1s

(not available)  # preinstall.js
(not available)  # decrypted stage two

SHA256s

43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70  # preinstall.js -> repo root of treasure-hunt-game, next-dashboard, padel-bot (byte-identical)
0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c  # decrypted stage two -> AES-256-CBC payload eval'd by preinstall.js

References Appendix

• “Glassworm Hacks OVH Clouds CLI tool”, OpenSourceMalware (@6mile), Oct. 19, 2026, https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool (source article; timeline, build metadata, preinstall.js loader analysis, Solana dead drop, hashes, defensive controls)
• “ovhcloud-cli security incident – October 19th, 2026” (GHSA-862f-55f5-vmvw), OVHcloud on GitHub, Oct. 20, 2026, https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw (additional source; envchecker collection list, staging folder, Solana RPC endpoints, exfil URL, root cause, MD5s, VirusTotal sample list)
• AlienVault OTX file indicator lookup, checked Oct. 29, 2026, https://otx.alienvault.com/ (no record for the binary MD5s)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/