Release asset swaps: lessons from the OVHcloud CLI incident

Six slides on the October 19, 2026 OVHcloud CLI release swap: what happened, which install paths were exposed, why a checksums.txt in the same release did not help, and what users and maintainers can do (pinned hashes, gh release verify-asset, immutable releases, private vulnerability reporting). Sources: https://github.com/ovh/ovhcloud-cli/issues/300, https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases, https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html. Longer write-up: https://dev.to/clydaralab/the-ovhcloud-cli-release-swap-why-the-checksum-file-didnt-help-5h27. Written with AI assistance.

Transcript