The replay shows the real binary’s embedded build metadata (commit 5ead8ef) and a one-command tell that reveals the attacker’s commit during version reporting; the exfiltration archived 18 secrets across multiple credential stores and config files to a Solana-like endpoint.

The exposure was detected via a pinned SHA-256 hash in a CI workflow, which flagged a mismatch and triggered forensic analysis; OVHcloud issued a mitigated release (v0.16.0) and released a detailed advisory GHSA-862f-55f5-vmvw.

The timeline runs from October 2025 compromise through October 2026 discovery and remediation, with multiple force-push events and a rollback to pre-compromise history, corroborated by security blogs and advisories.

Attack chain details include initial access through a compromised VS Code extension and a persistent NodeJS service, dormant contributor activity with probing GitHub actions, a March 2026 dry run with Solana dead-drop loaders, and five swapped releases that combined a credential stealer with staging in /tmp/envchecker-*.

Forensic findings show the payload did not expose arm64 Linux install.sh, Homebrew, or Docker image as attack paths, but a specific subcommand surfaced the swapped build indicators.

The report outlines IOCs and mitigations: rotate secrets, delete /tmp/envchecker-* directories, reinstall v0.16.0 with attestation verification, revoke tokens, and audit CI jobs that fetched releases during the window.

A coordinated supply-chain attack hit OVHcloud CLI releases v0.11.0 to v0.15.0 on October 19, 2026, allowing an attacker to replace binaries and checksums with a credential-stealer payload for about 94 minutes, later replaced by clean v0.16.0 attestation.

The attacker used a compromised contributor account (HassenBF) with access to published releases, injecting locally built binaries while the source repository itself remained untouched.

Two forensic takeaways: the missing -X version ldflag and the dirty build indicator helped fingerprint the swapped binaries; Homebrew casks pinned per-arch hashes provided resilience against this swap.

Technical indicators include the build commit 5ead8ef, pseudoversion v0.15.1-0.20261013083505-5ead8ef9b43d, and the exfil endpoint at 45.32.148.174/upload, with canary tokens confirming data exfiltration.