Content Quality: News piece of 921-928 words (range 400-1200), clear structure (Overview, What Happened, Who Was Exposed, How the Swap Was Identifiable, Why It Was Possible, What Remains Unknown, What Affected Users Were Told). Heavily attributed throughout ('according to The Hacker News', 'the outlet reports'), which is appropriate for a security incident naming a real company. No internal links, so no orphan-link risk; all 5 body URLs are in article.sources and vice versa.
Source Verification: Read all five gzipped snapshots (source-0..4.html.gz), text-extracted from raw HTML; all status 200, none thin, no archive fallback, so no live re-fetch was needed. suspicious_patterns is null for all five (no scanner hits to override). source-0 (The Hacker News, Swati Khandelwal, Oct 20 2026): confirms 'An attacker used a contributor's GitHub account to replace the download archives on five existing releases ... Monday, October 19'; 'The account had been hijacked'; 'live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC' (12:47 to 14:21 is exactly 94 minutes; the figure and 'up to' qualifier are THN's own, computed from the first replacement to OVHcloud's deletion, and the article attributes it to the outlet); OVHcloud lists v0.11.0 through v0.15.0 compromised and v0.10.0 clean; six files replaced on v0.15.0 incl. checksums.txt; i386/Windows i386/Windows arm64/WASM untouched; install script never checks a hash; Homebrew cask pinned SHA-256 and THN checked tap history; Docker latest tag pushed Sept 21; +dirty on OVHcloud's clean v0.16.0; v0.16.0 at 17:16 UTC under ovh-cds with signed tag; 'OVHcloud had not enabled it'; Klaba's second post quoted by Next ('immutability option not being activated ... without any checks by the company's CI/CD pipeline'), option now enabled, pipelines not affected; OpenSourceMalware GlassWorm link with the quoted phrase 'our inference' and 'nothing from the October binary has been tied to GlassWorm, because no copy of it was preserved'; OVHcloud has not said how credentials were taken, which files the binary reads, where it sends them, or download counts; detailed postmortem promised; Klaba's X advice to change every secret on the disk. source-1 (ovh/ovhcloud-cli issue #300): confirms v0.13.0-v0.15.0 assets replaced 2026-10-19, 'weeks after those releases were published' (verbatim), customer CI pinning SHA-256 of Linux arm64 archive, uploader HassenBF 'not a public member of the ovh org', module version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, tag 760fd72d, no private vulnerability reporting channel; maintainer rbeuque74 quotes 'All binaries involved have been deleted at 16:21 GMT+2.' and 'This release is immutable, so the assets attached to it can be trusted.' verbatim; post-mortem promised. source-2 (v0.16.0 release page): 'Immutable release. Only release title and notes can be modified.', released by ovh-cds 19 Oct 17:16, tag signed. source-3 (GitHub Docs): assets and tag cannot be changed after publication; 'All files attached to the release ... are protected from modification or deletion'; creating an immutable release generates a release attestation. source-4 (GitHub changelog, dated October 28, 2025 'Immutable releases are now generally available'): 'All new releases are immutable'; 'Existing releases remain mutable unless you republish them'. All allowlist hosts (thehackernews.com, github.com, docs.github.com, github.blog) are present by exact hostname in config/source_allowlist.txt; no allowlist edit needed.
Factual Accuracy: Compromise vector: sources say 'an attacker used a contributor's GitHub account' and 'the account had been hijacked' (THN); the issue says only that the uploader was a non-public-member account and asks whether it was a compromised account or token. The article attributes the vector to THN and states OVHcloud has not said how credentials were taken, so it does not assert more than the sources. Title 'Hijacked' matches THN's headline/body language; 'Live for up to 94 minutes' is directly supported by THN. Five releases v0.11.0-v0.15.0 and Oct 19 date match THN; the issue itself covers only v0.13.0-v0.15.0 and the article correctly attributes the wider list to THN/OVHcloud. Immutability not enabled: sourced to THN and Klaba's quoted post (the issue and release page are consistent with, but do not themselves state, it; the article attributes it to THN). Immutable-releases docs and GA date (Oct 28, 2025) match the GitHub pages. The malicious binary's behaviour is NOT claimed beyond sources: the article states it is unknown which files it reads or where it sends them. GlassWorm is attributed to OpenSourceMalware via THN, quoted as 'our inference' and presented as unconfirmed with no tie to the October binary. Minor residual: the lead says the files were 'a build designed to steal secrets' under 'the outlet reports'; THN attributes that characterisation to OVHcloud ('the cloud provider says'). This is a relay of the provider's statement and is reasonably covered by outlet attribution, but is not a correction-level issue.
Overall Assessment: All claims, numbers, times, versions, quotes and attributions trace to the five cited sources. Unknowns are stated as unknown, the GlassWorm link is attributed and unconfirmed, and no individual is blamed. APPROVE.