Five OVHcloud CLI releases turned into stealers for 94 minutes. A pinned hash caught it.

01 What happened on 19 October

The timeline comes from OVHcloud’s own advisory, published the next day [ OVHcloud 2026 ] . From report to clean-up took 31 minutes. That is a fast response. It still left an hour and a half in which anyone running the install script got the stealer.

The root cause goes back a year. OVHcloud traced it to an extension, color-picker-universal 2.8.91, which the developer installed on a personal MacBook on 20 October 2025. The extension called a Solana wallet that researchers had already tied to the GlassWorm campaign. Several of the developer’s personal repositories were tampered with in March 2026. The release swap itself was done with the stolen keys, from elsewhere. OVHcloud says the developer’s work laptop was not compromised as far as it knows [ OVHcloud 2026 ] .

02 Who was safe, and why

The install path decided everything. Same software, same day, five different outcomes.

GitHub has a setting built for this. An immutable release locks its tag and assets once published, and GitHub signs an attestation of what was in it [ GitHub Docs ] . You can then check a release with gh release verify. The OVHcloud CLI repository did not have it switched on, which OVHcloud names as the main issue. It is now on across the organisation. Releases published before that change stay editable unless they are republished.

03 What the stealer took

OVHcloud’s first public description said the binary was built to grab secrets from disk. The advisory has the full list. The malware went well past OVH credentials:

• Cloud accounts. AWS (including S3), Google Cloud and Azure credentials and configuration, plus DigitalOcean’s doctl config.
• Infrastructure access. Kubernetes and Docker configuration, Terraform credentials, SSH keys, .netrc, npm configuration and the global git config.
• AI assistants. Local databases of VS Code, Cursor, Continue, Sourcegraph Cody and OpenCode, sessions of the Hermes agent, and the Claude agent’s configuration and data directory.

That last group is the trend to watch. AI coding assistants keep provider keys, chat history and pasted code on the developer’s disk. We saw stolen AI keys turn into real bills after the OpenCode Console breach three days earlier. The GhostAction workflows in GitHub are hunting for the same keys in commits (our note on GhostAction).

The stealer copied everything into a temp folder named envchecker- plus nine or ten digits, archived it, and sent it to a server it looked up through Solana RPC calls. It never deletes that folder. If the folder exists on a machine, the binary ran there [ OVHcloud 2026 ] .

04 A sovereign cloud still ships through GitHub

Many European companies pick OVHcloud because it is French and holds their data under European law. That choice covers the data centre. The laptop where your engineer keeps the API keys sits outside it, and so does the tool that put them there.

OVHcloud is candid about the split. Its production CI/CD runs on private, internal git servers, audited and untouched by this incident. GitHub is where it publishes tools for customers, and there the controls were looser: a managed organisation with mandatory 2FA, but developers attach their personal GitHub accounts to it, "as do most of tech companies" [ OVHcloud 2026 ] . Two-factor authentication did not help, because the attacker used keys stolen from the developer’s own Mac.

Swap OVHcloud for any provider and the picture holds. Your cloud contract covers the region. Your actual exposure runs through every CLI, Terraform provider and SDK your team pulls from a public release page, each one published by a person with a personal account and a personal laptop. This CLI ran on machines that also held AWS, Azure and Google keys, and it took all of them.

05 Five checks for this week

Do the first one today if anyone in your company uses the OVHcloud CLI. The rest apply to any tool you install from a release page.

One customer with one pinned hash caught this in about an hour. Most teams have no such tripwire. Their build would have installed the new binary without complaint. We can show you how many of yours would. In 14 days you get every tool that reaches your engineers’ machines and pipelines, which ones verify what they install, which secrets sit beside them, and the change that closes each gap. Start with your Threat Map, from $5,000.