Evidence · DiggingBeagle record
OVHcloud: October 19 CLI release-asset compromise
- Source role
- vendor statement
Evidence record
Claim-level citations (2)
- supportsMalicious OVHcloud CLI binaries targeted local AI-assistant stores: Affected assets were v0.11.0-v0.15.0 downloaded October 19 between 14:47 and 16:21 UTC+2. OVHcloud says source and build infrastructure were unaffected and release immutability was subsequently corrected.
Summary; Technical report timeline; Targeted resources
- supportsMalicious OVHcloud CLI binaries targeted local AI-assistant stores: OVHcloud traced the developer-account compromise to color-picker-universal 2.8.91, installed on a personal MacBook on October 20, 2025; the release replacement later used stolen keys.
Root cause