Twilio's private GitHub repositories cloned by Codecov attacker, cloud comms platform confirms
Codecov's Bash Uploader script could be verified to check for tampering via a cryptographic checksum, but despite this it was a couple of months before the compromise was detected. The use of the script within GitHub actions was one example where the checksum was not inspected. Following the security incident, GitHub users raised an issue, "Checksum should be run on bash uploader script before execution," with one developer remarking that "the idea to directly and blindly execute a bash script pulled from the web is a giant security hole and a ticking bomb for future breaches." Codecov attemp...
Source: theregister.com