OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors

A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.

GlassWorm threat actors appear to have snagged a big fish.

French cloud provider OVHcloud on Monday disclosed that one of its GitHub repositories was compromised, and that threat actors replaced existing assets in the company's open source command-line interface (CLI) tool with malicious binaries. Octave Klaba, chairman and CEO of OVHcloud, revealed the incident in posts on social media platform X, urging users that downloaded the latest version of tool to "update it again very quickly" or delete it.

"The hacker used the GitHub account of one of the developers and added a binary whose job is to retrieve secrets from the disk," Klaba wrote in an X post. "The quality of the binary is poor but it can go all the way. If you are affected, please change all the secrets on your disk."

According to OVHcloud's postmortem on the incident, the scope of the impact on the supply chain appears to be small because the malicious binaries were only available for one hour and 33 minutes, though they were downloaded approximately 250 times.

However, the attack was tied to the threat actors behind the notorious GlassWorm, a self-propagating malware and botnet that first emerged in October 2025 and has since consistently targeted software supply chains, with previous GlassWorm attacks exhibiting long tails and extensive blast radiuses thanks to the worm functionality.

Compromised GitHub Account Leads to Repo Breach

The attackers used a compromised GitHub account for one of OVHcloud's developers to gain access to the company's ovhcloud-cli project, according to the postmortem. For a brief period, the threat actors swapped out the legitimate releases with malicious versions of the tool.

A GitHub user downloaded a poisoned version of the tool on Monday and, after observing suspicious activity, quickly reported a GitHub issue to OVHcloud, which investigated the repository and removed the malicious binary in about 30 minutes. OVHcloud's security team also scanned all of the company's repositories and determined that no others were affected.

Additionally, the cloud provider noted that its main CI/CD platform for production is run internally on a private Git repository instance, not hosted on GitHub, and thus they were not impacted by the attack.

According to OVHcloud's security team, the supply chain attack was enabled by a simple misconfiguration.

"The main issue was that the GitHub repository was not appropriately configured to ensure release immutability," the company wrote in the postmortem, meaning assets could be altered after the software was published. "This misconfiguration has been corrected immediately and the repository is not [sic] longer at risk. The same configuration has been applied to every repositories [sic]."

OVHcloud Attack Links to GlassWorm Threat Actors

It was initially unclear how threat actors obtained the compromised account used to access the CLI tool repository. However, in a blog post published yesterday on threat intelligence platform OpenSourceMalware, security researcher Paul McCarty tied the supply chain attack to GlassWorm threat actors via a Solana wallet address that was used in previous GlassWorm campaigns.

Perhaps more importantly, McCarty examined the developer account used to access the OVHcloud repository and found it has been compromised for seven months. "Its public repositories show a scripted history rewrite on 5 March 2026 and a hidden preinstall.js loader that decodes to a second stage using a Solana memo dead drop," he wrote. "The wallet is a known GlassWorm indicator, and the amend-and-force-push technique matches the ForceMemo campaign."

In that earlier campaign, GlassWorm infected dozens of extension packages on Open VSX, which is an open source alternative to Microsoft's Visual Studio Marketplace. However, OVHcloud's security team later discovered the developer installed a poisoned extension on a personal MacBook on Oct. 20, 2025.

Last October, researchers with cybersecurity vendor Socket flagged the exact extension version, [email protected], that OVHcloud referenced in its report.

"The extension's loader conceals executable code in invisible Unicode characters, queries Solana transaction memos to locate a remote payload, and downloads and executes that code," a spokesperson for the Socket Threat Research Team tells Dark Reading. "It also uses the same ivbase64 and secretkey response headers we documented in our GlassWorm themes investigation. Those behaviors are consistent with the GlassWorm loaders we've examined."

OVHcloud concurred and noted in its postmortem that the Solana wallet address points to GlassWorm. However, Socket notes that while the address matches what the vendor observed in its earlier Open VSX research, the extension file Socket retained embeds a different address. "We haven't established whether the address OVHcloud cites appears in a later payload stage, and we haven't independently analyzed the October CLI binaries," the spokesperson says.

Regardless of who the attack is attributed to, the Socket Threat Research Team stresses that a personal security lapse can lead to enterprise security risks.

"OVHcloud's account shows how an extension infection on a personal machine can lead to malicious software reaching an employer's users," the spokesperson says. "The company says its source code and build chain were unaffected, yet stolen credentials still allowed attackers to replace the binaries distributed through its official releases."