Résumé
Codecov is a code-coverage tool wired into the CI pipelines of about 29,000 organisations. On 31 January 2021, attackers extracted a Google Cloud Storage key from an error in Codecov's Docker image and used it to quietly alter Codecov's "Bash Uploader," the script customers pipe into their CI to upload coverage reports. For two months, undetected, that tampered script copied the secrets and git repository URLs out of every CI environment it ran in, the AWS keys, deploy keys, API tokens, and passwords sitting in build environment variables, and sent them to the attackers. It is the canonical lesson in the danger of piping a remote script into your shell, and in how one tool's compromise harvests thousands of downstream secrets.
How it happened
Codecov distributed its uploader as a Bash script that customers ran in CI, very often with the pattern curl ... | bash, piping a remote script straight into the shell. That convenience was the weakness. Attackers obtained a credential (an HMAC key for a Google Cloud Storage service account) exposed in an intermediate layer of Codecov's self-hosted Docker image, and used it to modify the uploader script where it was actually served from, a Google Cloud Storage bucket.
From 31 January, the altered script did its normal job and one extra thing: a single added line, buried in the 1,800-line script, scooped up the secrets in the CI environment (every environment variable, including AWS IAM keys, deploy keys, API keys, service-account credentials, tokens, and passwords) plus the git remote origin URLs (which let the attackers reach private source repositories), and exfiltrated them to an attacker-controlled server. Because customers were piping the live script straight into a shell, they ran whatever Codecov served, and the same compromised uploader was also bundled into Codecov's GitHub Action, CircleCI Orb, and Bitrise Step, so many victims never ran curl | bash directly. It is a supply-chain attack on the CI toolchain, and it ran undetected for roughly two months until a customer noticed the script's checksum did not match the hash Codecov published.
The damage
Codecov has about 29,000 customers, and more than 23,000 were reported affected, so the harvested secrets were keys to thousands of other companies' cloud accounts, code repositories, and services; the real damage was the second-order breaches they enabled. Named downstream victims included HashiCorp (whose exposed GPG signing key, used to sign its own product releases, had to be rotated), Rapid7 and Monday.com (source code accessed), and Twilio. Reuters reported the attackers used automation to pivot into hundreds of customer networks, which drew a federal investigation. Coming only weeks after SolarWinds, it reinforced the same uncomfortable truth: a single trusted tool sitting in everyone's pipeline is a master key to thousands of environments.
Why Codecov still matters
Codecov leaves two durable lessons. First, curl | bash is dangerous: piping a remote script into your shell means you execute whatever the server serves at that moment, including a tampered version, so verify integrity with a checksum, signature, or SRI, or vendor a pinned, reviewed copy. Second, CI secrets are gold: build environments hold the credentials to everything, so scope them to least privilege, rotate them fast on any tooling compromise, and restrict CI runner egress so a poisoned tool cannot quietly phone the secrets home. It is a sibling of SolarWinds in the 2020-21 supply-chain reckoning that made CI/CD security a first-class concern.
Comment le corriger
- Assume every secret exposed to the tampered uploader is compromised: rotate all CI credentials, cloud keys, and tokens immediately.
- Pin and integrity-verify the uploader, and any CI tooling, going forward, and hunt for unauthorized use of the exposed credentials.
- Review CI logs and cloud audit trails for attacker activity using the stolen secrets.
Comment l’éviter
- Verify the integrity (checksum, GPG signature, or SRI) of any uploader or installer script before executing it.
- Avoid piping remote scripts straight into a shell (curl | bash) in CI; vendor and pin a reviewed copy.
- Scope CI secrets to least privilege and rotate them on any uploader or tooling compromise.
- Restrict and monitor CI runner egress so a poisoned tool cannot exfiltrate environment variables.
- Pin third-party tooling to a known-good version and watch for unexpected upstream changes.
Références
- https://about.codecov.io/apr-2021-post-mortem/
- https://discuss.hashicorp.com/t/hcsec-2021-12-codecov-security-event-and-hashicorp-gpg-key-exposure/23512
- https://www.bleepingcomputer.com/news/security/hundreds-of-networks-reportedly-hacked-in-codecov-supply-chain-attack/
- https://blog.gitguardian.com/codecov-supply-chain-breach/
Vulnérabilités liées
Tout Supply chain →- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-SHAI-HULUD-2-2025
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.