Threat feed

OVHcloud CLI envchecker

OVHcloud CLI release-asset compromise: envchecker stealer distributed via hijacked GitHub releases

Posted · Updated · Spectrum Delta Research Team

Summary

OVHcloud's security advisory (GHSA-862f-55f5-vmvw, Oct 20, A/3) confirms that a compromised OVHcloud GitHub developer account was used to replace the release binaries of five already-published ovhcloud-cli releases (v0.11.0–v0.15.0) with trojanized builds on 19 October 2026 between 14:47 and 16:21 (UTC+2). The malicious builds are the original Go CLI recompiled with a stripped stealer embedded in an 'envchecker' module that collects cloud, SSH, Git and AI coding-assistant credentials from developer machines and exfiltrates them as an archive to a reported HTTPS upload endpoint, with associated Solana RPC calls whose exact role the primary does not specify. Users who downloaded or updated the CLI during the 94-minute window (~250 downloads) and ran the binary should treat the secrets on that machine as compromised; source, build chain and CI/CD were never touched.

Breakdown

Adversary

OVHcloud states the Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC used by the compromising extension is known as belonging to the GlassWorm threat actor

Procedures (2)

  1. Release-asset replacement via hijacked maintainer account

    Compromise software supply chain: release-asset replacement

    • T1195.002Supply Chain Compromise: Compromise Software Supply Chain

    Logs

    • CI build logs (hash-pinned) · Pinned-checksum verification failures in CI build logs

    Detectors

    No known detector

Click to expand remaining (1) procedure

  1. envchecker staging and credential collection on endpoint

    envchecker module: local secret staging and collection

    • T1005Data from Local System

    Logs

    • Sysmon / EDR · envchecker-[0-9]{9-10} temp dirs, credential-path reads, archives

    Detectors

    No known detector

Indicators of compromise

Hunt only

(GHSA-862f-55f5-vmvw (https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw), A/3) — exfil upload server 45.32.148[.]174:443; Solana RPC: solana.drpc[.]org, solana-rpc.publicnode[.]com, solana.api.pocket[.]network, api.mainnet-beta.solana[.]com, solana.api.onfinality[.]io/public; Solana wallets BHaDaVbdCYFNaKZGn7yLXFneWoJHZgLiBYkHxVrjyALF (stealer) and BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (GlassWorm-linked); persistence C2 162.33.177[.]177; malicious VS Code extension color-picker-universal 2.8.91; MD5s of the five trojanized binaries and the envchecker-[0-9]{9-10} temp-folder marker; full hashes and five VirusTotal sample links in the thread; assessed 2026-10-24, hunt-only.

Detailed

MD5 (trojanized binaries): Darwin arm64 6f2f086239f3d88eb2750e871901927d, Darwin x86_64 347e65eb7f2d78d1c6872690272a6cc3, Linux arm64 01f57206d37c28cf711677f612052913, Linux x86_64 301bff0b51980b9e76c93633e7cfd3bd, Windows x86_64 6a3cf153338c416169cda2fe704c8848. Exposure marker: temp folder envchecker-[0-9]{9-10} (never deleted). Go build metadata: module github.com/ovh/ovhcloud-cli v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, vcs.modified=true, vcs.revision 5ead8ef9b43d354dfb5caadff803b11afc8c5c58, -ldflags='-s -w'. Exfil: 45.32.148[.]174:443 (reported HTTPS upload endpoint /upload, time-sensitive). Solana RPC: solana.drpc[.]org, solana-rpc.publicnode[.]com, solana.api.pocket[.]network, api.mainnet-beta.solana[.]com, solana.api.onfinality[.]io/public. Wallets: BHaDaVbdCYFNaKZGn7yLXFneWoJHZgLiBYkHxVrjyALF (stealer RPC), BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC (GlassWorm-linked extension/march compromises). Persistence C2: 162.33.177[.]177. Initial-access extension: color-picker-universal 2.8.91 (installed 2025-10-20). Affected: v0.11.0–v0.15.0 release assets downloaded 12:47–14:21 UTC Oct 19 2026 (~250 downloads); v0.10.0 and earlier and v0.16.0 clean. Execution caveat: ~250 downloads is a download count, not an infection count — the advisory ties compromise to download AND run. Five VirusTotal samples: e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4, 3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a, 3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927, 25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec, f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a (links: https://www.virustotal.com/gui/file/e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4, https://www.virustotal.com/gui/file/3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a, https://www.virustotal.com/gui/file/3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927, https://www.virustotal.com/gui/file/25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec, https://www.virustotal.com/gui/file/f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a). Root-cause chain indicators (2025–March 2026, NOT October-stealer indicators): color-picker-universal 2.8.91, persistence C2 162.33.177[.]177, wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC. All from the primary (GHSA-862f-55f5-vmvw (https://github.com/ovh/ovhcloud-cli/security/advisories/GHSA-862f-55f5-vmvw), A/3), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of OVHcloud CLI envchecker? Bring them to the community.

Discuss in the Tradecraft Slack