OVHcloud CLI releases 0.11.0-0.15.0 compromised via GitHub account hijack for 94 minutes

The attack left source, tags, and build pipeline untouched; only pre-built release archives and checksums.txt were swapped with plain go build outputs from commit 5ead8ef dated October 13. Evidence from go version -m on the malicious binaries shows pseudo-versions, mismatched commit hashes, and -ldflags -s -w absent from OVHcloud's signed pipeline. The install.sh script, upgrade command, and direct GitHub downloads performed no hash verification, exposing any user who fetched during the window.

Homebrew and pinned go install paths were unaffected because their casks locked original SHA-256 values. Docker images and pre-October 19 installs also escaped. This matches the pattern seen in prior GitHub release tampering where tokens grant write access to assets without touching the repository itself.

The incident highlights that immutable releases, introduced only after the fact with v0.16.0, remain an afterthought for most CLI maintainers. CI jobs and curl | sh patterns continue to treat release assets as trusted without reproducible builds or SLSA provenance.

Next steps include mandatory asset signing, broader adoption of Go's buildinfo checks in detection tooling, and audits of contributor OAuth tokens across cloud-provider repositories.