Developers who installed five compromised OVHcloud command-line releases may have exposed secrets stored on their machines. Versions v0.11.0 through v0.15.0 were altered on GitHub before the malicious downloads were blocked. A compromised contributor account replaced existing release files without changing the source repository or CI/CD pipeline. The clean replacement is v0.16.0, while v0.10.0 was unaffected.
Why It Matters
The malicious binary was designed to retrieve secrets from disk, placing developer and operations workstations at particular risk. Users who built from source or used the Docker image were not affected by the reported release-asset replacement. For leaders: release integrity controls must cover downloadable assets, not only build pipelines. For defenders: identify affected installations and rotate every secret stored on those systems. The larger lesson is that a clean repository does not guarantee that published binaries are trustworthy.
What Defenders Should Do
Replace affected releases with v0.16.0, rotate secrets from a clean system and enforce immutable release assets.