Malicious OVHcloud CLI builds replaced GitHub release archives for 94 minutes

Between 12:47 and 14:21 UTC on 19 October 2026, the download archives for five OVHcloud CLI releases (v0.11.0–v0.15.0) on GitHub were swapped for builds that read credentials from disk. A customer's CI job with a pinned SHA-256 caught the change; OVHcloud shipped an immutable v0.16.0 and enabled release immutability.

• Six files were replaced in v0.15.0, including checksums.txt, and the same set in v0.11.0–v0.14.0
• The attacker used a compromised contributor account with write access; the CI/CD pipeline was never involved
• Homebrew and go install were unaffected as original hashes and tags stayed intact
• OVHcloud advises rotating all keys on affected machines and installing v0.16.0