OVHcloud CLI repository hit by supply chain attack

A repository for OVHcloud's CLI was briefly compromised after a hacker used a developer's GitHub account to publish a malicious binary that retrieves secrets from disk. A customer spotted the release, which was blocked in 94 minutes; versions v0.11.0–v0.15.0 are affected, while v0.10.0 and 0.16.0 are clean.

• Affected CLI versions are v0.11.0 through v0.15.0; v0.10.0 and 0.16.0 are clean
• The malicious release was blocked 94 minutes after being spotted
• A customer, not internal monitoring, flagged the incident
• CEO Octave Klaba urged affected users to change all secrets on disk