Codecov (2021): A Modified CI Script That Harvested Secrets for Two Months

Summary

In April 2021, Codecov disclosed that its Bash Uploader script, used in a very large number of CI/CD pipelines to report code coverage, had been modified by attackers. The modification was present from approximately late January 2021 until discovery in April, roughly two months of undetected operation.

Technical Root Cause

Attackers gained access due to an error in Codecov's Docker image creation process that allowed extraction of a credential, which was then used to modify the Bash Uploader script hosted for download. The modified script exfiltrated environment variables from the CI environment to an attacker-controlled server. Because CI environments routinely hold credentials, tokens, and keys as environment variables, this effectively harvested secrets from every pipeline running the compromised script.

This maps to CWE-522 (Insufficiently Protected Credentials) on the victim side and to a build/distribution integrity failure on the vendor side.

Why It Mattered

The attack targeted the CI pipeline itself rather than shipped application code, which is a category many organizations under-monitored at the time. It also demonstrated the risk of the common curl | bash installation pattern: a script fetched fresh from a remote URL at every build, with no integrity check pinning what was actually executed.

OWASP / CWE Mapping

• CWE-522: Insufficiently Protected Credentials
• CWE-494: Download of Code Without Integrity Check
• OWASP A08:2021: Software and Data Integrity Failures

Lasting Impact

Codecov drove much wider adoption of checksum verification (SHASUM validation) for downloaded CI scripts, and reinforced guidance to treat CI/CD environment secrets as highly sensitive with short rotation cycles. It is regularly cited alongside SolarWinds as evidence that the build pipeline is itself a first-class target.

How Safeguard Helps

Safeguard's supply chain security coverage includes CI/CD pipeline integrity considerations, and secrets detection helps identify credentials exposed in build environments that would be harvested by exactly this kind of compromise.

References

• Codecov incident disclosure: https://about.codecov.io/security-update/
• CWE-494: https://cwe.mitre.org/data/definitions/494.html