Codecov: when your CI script steals your secrets

Codecov disclosed this month that its Bash Uploader script, used in thousands of CI pipelines, had been modified by attackers since late January. The change sent the environment variables from customers’ CI runs to the attackers. Those variables often include cloud keys, API tokens and database passwords.

If you used it:

1. Rotate every secret that was available to those CI jobs. Assume they were copied.
2. Check cloud and Git logs for use of those credentials since January.
3. Re-check code and releases built in that period if your pipeline could push them.

For everyone, the habit to drop is curl ... | bash in pipelines. Instead:

• Pin tools to a version and verify their checksum or signature.
• Give each CI job only the secrets it needs.
• Prefer short-lived credentials over long-lived keys stored in CI settings.