Codecov incident (Incident)

In April 2021 Codecov experienced a supply-chain compromise: a threat actor extracted an HMAC key from a public Docker image, used it to alter the Codecov Bash Uploader hosted in Google Cloud Storage to include a malicious payload, and that tampered uploader was downloaded by and led to data exfiltration from multiple customer environments; the incident was discovered after a customer observed a checksum mismatch and resulted in public incident reports and vendor responses.