OVHcloud’s CLI was poisoned for 94 minutes by a GitHub account stolen months earlier through a VS Code extension
On October 19, 2026, a compromised developer GitHub account replaced OVHcloud CLI binaries (v0.11.0 through v0.15.0) with a secret stealer for 94 minutes, reaching roughly 250 downloads. Turn on GitHub release immutability, sign your artifacts, and remove personal accounts from publication privileges.