Skip to content
Supply Chainopen-source-securityCI/CD

OVHcloud CLI supply chain attack: GlassWorm compromises developer account

2 min read
Share

What happened

Threat actor GlassWorm compromised the npm account of a contributor to the official OVHcloud CLI package. The attacker published a malicious patch version containing a credential-harvesting module triggered on any OVHcloud CLI configuration file write. The malicious version was live for approximately 6 hours before OVHcloud's security team identified and yanked it. CI/CD pipelines using the npm package without pinned versions would have received the malicious update during that window.

The harvested credentials

The injected module targeted OVHcloud application key, consumer key, and application secret values from the local configuration file at ~/.ovh.conf and any project-level .ovh.conf files. In a CI/CD context this typically means pipeline cloud deployment credentials. An attacker with these values can create new cloud instances, modify DNS records, access object storage, and pivot to attached services.

Timeline

  • Oct 19, 14:22 UTC: malicious version published to npm
  • Oct 19, approximately 17:00 UTC: automated npm scanner flags suspicious network call in package
  • Oct 19, 20:05 UTC: OVHcloud yanks malicious version, posts incident notice
  • Oct 20: OVHcloud begins notifying affected npm users who downloaded the version during the exposure window

Remediation steps

  • Check your npm install logs for the affected version (exact version number in OVHcloud incident notice). If your CI/CD ran during the exposure window, assume credentials are compromised.
  • Rotate all OVHcloud API keys referenced in .ovh.conf files in any system that ran npm install during the window. This includes CI/CD service accounts.
  • Pin npm dependencies to exact versions in package-lock.json and enforce lockfile verification in your CI/CD pipelines. An unpinned package in CI is a standing supply chain attack surface.
  • Enable MFA on all npm accounts that can publish your organization's packages. Compromised npm credentials are the primary attack surface for this class of attack.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization uses OVHcloud CLI or npm packages from this ecosystem and wants help with supply chain dependency auditing.

Related articles

CVEVulnerability ResearchSupply Chain

Atlassian CVE-2026-21589: exploitation began two hours after the public PoC dropped

A critical arbitrary file-read flaw in every Atlassian Data Center product was being actively exploited within two hours of watchTowr publishing a public proof of concept. On Crowd and Jira, it exposes admin credentials in a single request.

Supply Chaincredential-theftvulnerability

ConnectWise Cloud Backup breach: 173 Microsoft 365 tenants compromised via stolen service-principal credentials

Attackers used stolen credentials for ConnectWise's Cloud Backup service to access 173 or more Microsoft 365 tenants, bypassing MFA entirely because the login came from an application identity, not a human.

Supply Chaincredential-theft

ConnectWise Cloud Backup supply-chain attack: how attackers got into 162 Microsoft 365 tenants

Attackers stole ConnectWise Cloud Backup application credentials and used them to access Microsoft 365 tenants across the MSP customer base. MFA did not apply because no user logged in. At least 162 tenants compromised. This is a master key attack on MSP tooling.