Codecov Bash Uploader Security Incident Overview

• •Unauthorized access to Codecov's Bash Uploader script occurred from January 31, 2021.
• •Sensitive information, including environment variables, may have been exposed to the attacker.
• •Affected users received notifications and guidance on assessing their exposure.

On April 1, 2021, Codecov discovered unauthorized modifications to its Bash Uploader script, which allowed a threat actor to extract sensitive information from users' CI environments. The malicious changes targeted users of the Bash Uploader, Codecov GitHub Action, CircleCI Orb, and Bitrise Step. The attacker exploited a flaw in Codecov's Docker image creation process to gain access to credentials. Affected users were notified via email and in-app alerts. Codecov engaged a third-party forensic firm to investigate the breach and implemented security measures to prevent future incidents. The incident was reported to law enforcement, and Codecov took steps to revoke compromised keys and audit their systems. The investigation revealed that the unauthorized access began on January 31, 2021, and continued until the incident was detected.