Hundreds of customer networks have been breached in the Codecov system breach, expanding the scope of this system breach beyond just Codecov’s systems. Hackers used the compromised Bash Uploader script to alter the company’s IP address in order to gain access to hundreds of client networks. The incident got the attention of U.S. federal investigators since the breach has been compared to the recent SolarWinds attacks that the government has attributed to the Russian Foreign Intelligence Service. The list of companies and GitHub projects using Codecov is extensive, as seen by BleepingComputer.
Source: https://www.bleepingcomputer.com/news/security/hundreds-of-networks-reportedly-hacked-in-codecov-supply-chain-attack/