OVHcloud warns of backdoored CLI releases on GitHub

Attackers hijacked a developer's GitHub account and injected infostealer malware into OVHcloud CLI releases 0.11.0 through 0.15.0. The compromised build appeared at 14:47 on October 19 and was blocked at 16:21 after a customer report; versions 0.10.0 and 0.16.0 are clean. OVHcloud enabled GitHub release immutability and urges affected users to rotate all secrets.

• Compromised CLI releases 0.11.0–0.15.0; 0.10.0 and 0.16.0 are clean
• Malicious build appeared Oct 19 at 14:47, blocked at 16:21
• GitHub release immutability was disabled; CI/CD pipelines unaffected
• macOS, Linux and Windows affected; source builds and Docker images clean