The OVHcloud CLI attack did not ship a bad new version. It rewrote five releases that already existed
2026-10-20Security
An attacker with a hijacked contributor account swapped the files attached to releases going back several versions, for about 94 minutes. Pinning a version does not help when the artefact behind the version can be replaced.