Codecov says its Bash Uploader script was altered periodically from 31 January 2021 until a customer noticed, on 1 April 2021, that the script's checksum did not match the one published on GitHub. The single added line sent CI environment variables to a third party server.
What Codecov reported
Codecov's advisory says unauthorized changes to the uploader happened in 108 windows of time between 31 January and 1 April 2021. The only change, per the company, was one added line that sent the repository remote and the environment variables to an outside server. Related tools that used the script, including the Codecov GitHub Action, the CircleCI orb and the Bitrise Step, were also affected.
On how the attacker got in, the advisory says an error in the creation of Codecov's Docker image let the attacker extract a credential used to modify the script. Codecov secured the script on 1 April and published the advisory on 15 April 2021.
What was exposed
Anything in the CI environment while the script ran: credentials, tokens and keys, the git remote URL, and whatever those credentials could reach. Codecov said it later obtained evidence of how some of the stolen variables were used.
Why a checksum mattered
The advisory says customers who verified the uploader's checksum before use may not be affected. The detection came from the same habit: a customer compared the checksum of what they downloaded with the published value and saw a difference.
Compare that with the common pattern of fetching a script from a URL and piping it into a shell in every build. That pattern trusts the host on every run.
How to handle scripts your builds download
- Prefer a pinned, versioned release over a URL that always returns the latest.
- Verify a checksum or signature that you obtained from a different place than the download.
- Better still, copy the script into your own repository or artifact store after review, and update it by pull request.
- Run steps that upload data in a job that holds as few secrets as possible.
- Alert when a downloaded script changes unexpectedly.
Why it ran for two months
A script fetched fresh on every run means every run is a new trust decision. With 108 windows of change spread over about two months, most runs may have fetched the clean version, which makes odd behavior hard to spot. Only a comparison against a known value turns that quiet drift into a signal.
If you think you were exposed
Codecov's advice was to check use between the dates, run env in the pipeline to see what was available, invalidate and regenerate sensitive credentials, and audit how they were used. That is still a reasonable template for any similar notice.
Quick check
Was the Codecov product itself the target?
The advisory describes tampering with the Bash Uploader script and its dependent uploaders. The goal, as shown by the added line, was collecting CI environment data.
Would a checksum have helped if the attacker also changed the published checksum?
Not if both came from the same compromised source. That is why a checksum from a separate channel, or a copy you reviewed and stored yourself, is stronger.
Sources
- Codecov, Bash Uploader security update.
Last reviewed: 19 October 2026.
