From ehackingnews.com
U.S. federal authorities are investigating a safety violation at Codecov, which works on selling a tool that allows developers to calculate their codebase coverage and works for more than 29,000 clients worldwide. The organization acknowledged the violation and reported that for months it remained unnoticed.
The violation impacted an unaccompanied number of customers, including Atlassian, Proctor & Gamble, GoDaddy, and Washington Post. To be specific, attackers used a bug of the Docker image to access a Bash Uploader script to map development environments and report back to the company in the company production. In the wake of the discovery of the violation on April 1st, 2021, a follow-up investigation discovered that the threat actor had access to their system for months, at least since 31 January. Three additional bash uploaders were also affected by the vulnerability, including the Codecov CircleCI Orb, Codecov-actions for GitHub, and Codecov Bitrise Phase.