Codecov
Codecov is a code coverage reporting tool widely integrated into CI/CD pipelines, helping development teams track test coverage across their codebases. The service was the subject of a notable supply chain attack in 2021.
Timeline (last 90 days)
In 2021, the Codecov supply chain security incident occurred, as did an attack targeting tj-actions/changed-files.
The Codecov incident occurred in 2021, when attackers modified Codecov's CI script, causing enterprises using its service to leak local environment variables to the attackers when uploading code coverage reports
In the 2021 Codecov supply chain attack, attackers tampered with CI/CD pipeline scripts to silently send customers' environment variables and keys to an external server via HTTP requests, going undetected for months.
All Facts (3)
The Codecov incident occurred in 2021, when attackers modified Codecov's CI script, causing enterprises using its service to leak local environment variables to the attackers when uploading code coverage reports
50%UnverifiedIn 2021, the Codecov supply chain security incident occurred, as did an attack targeting tj-actions/changed-files.
50%UnverifiedIn the 2021 Codecov supply chain attack, attackers tampered with CI/CD pipeline scripts to silently send customers' environment variables and keys to an external server via HTTP requests, going undetected for months.
50%