A customer found the Codecov Bash Uploader tampering by comparing a checksum, after the script had been altered on and off since 31 January 2021. Your organization would have caught it sooner if you verify downloaded scripts, limit what secrets CI can see, and watch outbound connections from builds.
What happened?
Codecov's own security update gives this timeline. On 31 January 2021, periodic unauthorized changes to the Bash Uploader began. On 1 April 2021 a customer noticed that the shasum of the file on GitHub differed from the file they downloaded and reported it, and Codecov secured the script that day. Affected users were emailed on 15 April, and more detail followed on 29 April.
Codecov says the attacker obtained a credential through an error in its Docker image creation process. The injected line sent the output of git remote -v and env to an external server with curl. The same uploader was used by the Codecov GitHub Action, the CircleCI Orb and the Bitrise Step.
What leaked was whatever lived in the CI environment while the script ran: credentials, tokens and keys, plus repository URLs.
Would your org have caught it?
This is a test of your controls, not a judgment of anyone. Ask six questions.
1. Do you verify what you download in CI? Customers who validated the checksum could spot the change. A pipeline step that runs curl | bash trusts whatever the server sends that minute. Pin a version and a hash, and fail the build if it differs.
2. What secrets does a build step see? The script read the whole environment. If every job had cloud admin keys in environment variables, the leak was serious. If each job had a narrow, short-lived token, there was little to steal.
3. Can CI reach the internet freely? A build that can send data to any host will. Egress allowlists for build runners would have blocked an unknown destination, and logs would show the attempt.
4. Do you have an inventory of third-party actions and scripts? Codecov told customers to find uses of the uploader in all repositories. If that took a day of grep across hundreds of repos, you learned something.
5. Do you rotate on a schedule? Codecov advised revoking and regenerating any exposed sensitive variables. Teams with rotation automation did that in an hour.
6. Do you review changes to pipeline definitions? Pin third-party actions by commit hash rather than a moving tag.
What does the response look like?
Follow Codecov's own steps. Work out whether you used the uploader between 31 January and 1 April 2021 without checksum validation. Run env in a pipeline to see which variables were exposed. Revoke and regenerate anything sensitive, then audit where those credentials were used. Check local copies of the script for the injected line.
What to do
- List every script and action your pipelines fetch, with source and version.
- Pin each one by hash, and fail on mismatch.
- Give each job the least secrets it needs, with short lifetimes.
- Restrict outbound traffic from build runners to an allowlist.
- Alert on new outbound destinations from CI.
- Automate secret rotation, and rehearse it once.
- Keep build logs long enough to look back several months.
Quick check
How was the Codecov tampering detected?
A customer compared the shasum of the downloaded uploader with the value published on GitHub, saw a mismatch and reported it, per Codecov's security update.
What data did the injected line send?
The output of the git remote command and the environment variables of the CI job, according to Codecov.
Sources
Last reviewed: 18 October 2026.
