Codecov
Codecov is a code coverage reporting tool widely integrated into CI/CD pipelines, helping development teams track test coverage across their codebases. The service was the subject of a notable supply chain attack in 2021.
Core Facts
Timeline (last 90 days)
Coverage of changed files must not decrease, and Codecov or SonarQube can enforce diff coverage in CI, which is fairer than setting a global target on a legacy codebase.
In 2021, the Codecov supply chain security incident occurred, as did an attack targeting tj-actions/changed-files.
The Codecov incident occurred in 2021, when attackers modified Codecov's CI script, causing enterprises using its service to leak local environment variables to the attackers when uploading code coverage reports
In the 2021 Codecov supply chain attack, attackers tampered with CI/CD pipeline scripts to silently send customers' environment variables and keys to an external server via HTTP requests, going undetected for months.
All Facts (5)
The Codecov incident occurred in 2021, when attackers tampered with CI tool scripts to steal enterprise environment variables and keys at scale.
65%UnverifiedCoverage of changed files must not decrease, and Codecov or SonarQube can enforce diff coverage in CI, which is fairer than setting a global target on a legacy codebase.
50%UnverifiedThe Codecov incident occurred in 2021, when attackers modified Codecov's CI script, causing enterprises using its service to leak local environment variables to the attackers when uploading code coverage reports
50%UnverifiedIn 2021, the Codecov supply chain security incident occurred, as did an attack targeting tj-actions/changed-files.
50%UnverifiedIn the 2021 Codecov supply chain attack, attackers tampered with CI/CD pipeline scripts to silently send customers' environment variables and keys to an external server via HTTP requests, going undetected for months.
50%