Supply-chain attacksBriefConfirmed by two or more outlets
OVHcloud CLI GitHub release assets swapped
Releases v0.11.0 to v0.15.0 had binaries and `checksums.txt` replaced with an infostealer for about 94 minutes.
- Disclosed
What happened
- Releases v0.11.0 to v0.15.0 had binaries and `checksums.txt` replaced with an infostealer for about 94 minutes. Fixed: v0.16.0.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.