Unverified50% confidenceEventExact time
In the 2021 Codecov supply chain attack, attackers tampered with CI/CD pipeline scripts to silently send customers' environment variables and keys to an external server via HTTP requests, going undetected for months.
1
Sources
50%
Confidence
Long-term
Relevance
9/8/2026
First Seen
Sources
Related Entities
Related Claims
Unverified2022年Codecov事件中攻击者通过篡改Codecov的构建脚本，导致数千家企业CI环境中的环境变量被静默上传至攻击者76% similarUnverifiedThe Codecov incident occurred in 2021, when attackers tampered with CI tool scripts to steal enterprise environment variables and keys at scale.75% similarUnverified2020 年 SolarWinds 攻击中攻击者在构建流水线植入恶意代码，代码仓库哈希链未被触动；2021 年 Codecov 事件通过篡改 CI 上传脚本窃取凭证，未涉及 Git 历史重写68% similarUnverifiedIn 2022, the node-ipc malicious code incident occurred, in which a well-known open-source package was implanted with destructive code68% similarUnverified勒索软件攻击者往往会在潜伏数周至数月后才触发加密程序，期间通过横向移动渗透备份系统、域控制器等关键节点66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/878822API
curl https://kongchang.com/api/v1/knowledge/claims/878822MCP
get_claim(id=878822)