Threat Brief: Codecov Bash Uploader
Summary: Codecov disclosed on April 16 that an adversary had modified its Bash Uploader script, which customers use to send code coverage reports to the Codecov platform for analysis. Codecov's investigation found that beginning January 31, a threat actor made periodic, unauthorized alterations to the script to export information from users' continuous integration environments to a third-party server outside Codecov's infrastructure, potentially including credentials, tokens, services, datastores and application code.
Key Takeaway: The tampering ran from January 31 until the April 16 disclosure, and the script also appears in other tools, so exposure is not limited to clients who used the Bash Uploader directly - credentials, tokens and application code from CI environments may have left for a third-party server for roughly two and a half months.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026