Codecov Bash Uploader compromise via credential extracted from Docker image
An error in Codecov's Docker image creation process let an attacker extract a Google Cloud Storage credential, which was used from January 31, 2021 to modify Codecov's Bash Uploader script. The altered script sent environment variables, including credentials and tokens, from customers' CI pipelines to the attacker. A customer spotted a checksum mismatch on April 1, 2021 and Codecov disclosed on April 15, 2021.
- Victim
- Codecov and its customers
- Industry
- Technology
- Country
- United States
- Intrusion began
- Jan 31, 2021
- First disclosed
- Apr 15, 2021
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Short-lived, narrowly scoped credentials kept out of build artifacts, plus CI pipelines that do not expose long-lived secrets as environment variables, would have limited both the initial access and the downstream harvest.
Go deeper on SWI
- Technique: Secrets in repositories and CI
- Technique: Static API key abuse
Sources
- Bash Uploader Security Update, Codecov, Apr 15, 2021
- Codecov Releases New Detections for Supply Chain Compromise, CISA, Apr 30, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). Codecov Bash Uploader compromise via credential extracted from Docker image. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-codecov-bash-uploader/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.