On October 19, an attacker hijacked a contributor's GitHub account and replaced download archives across five releases of OVHcloud's command-line tool with secret-stealing malware, which remained live for up to 94 minutes before being removed. Users who installed or updated the CLI during that window via the official install script, direct download, or the tool's built-in upgrade command on macOS, Linux x86_64/arm64, or Windows x86_64 were potentially exposed, while Homebrew and source-based installations were unaffected. The attack was made possible because OVHcloud had not enabled GitHub's release immutability feature, allowing anyone with repository write access to silently replace release files; anyone affected is advised to immediately rotate all secrets stored on the compromised machine and install the clean, immutable v0.16.0 release.
