Developer secrets were placed at risk when attackers replaced OVHcloud command-line tool assets with malicious binaries. The binaries were available for one hour and 33 minutes and downloaded approximately 250 times. They were designed to retrieve secrets from disk. Attackers used a compromised developer account, while mutable release assets allowed them to replace files after publication.
Why It Matters
The main private production build environment was not affected, but users trusted files distributed through an official repository. Evidence linked the activity to GlassWorm, although one element of the attribution was not independently verified. For leaders: a personal endpoint or developer account can create enterprise supply-chain exposure. For defenders: identify downloads from the affected window, remove the binaries, and replace disk-accessible secrets. The larger lesson is that official distribution channels still require immutable releases and artifact verification.
What Defenders Should Do
Investigate affected downloads, rotate accessible secrets, and enforce immutable release assets across repositories.