From Eli Hooten, CodeCov's CTO, in a personal message:
> Based on the nature of this attack I do not believe malicious actions were executed directly against the CI pipeline, nor do we have any evidence of it. I have included the malicious bash script for your review so you can fully understand the scope of the attack. Of interest is line 525
> line 525 was the only change we've observed. I have removed the IP address in the curl command as it is part of an ongoing federal investigation
> Based on the nature of this attack I do not believe malicious actions were executed directly against the CI pipeline, nor do we have any evidence of it. I have included the malicious bash script for your review so you can fully understand the scope of the attack. Of interest is line 525
> line 525 was the only change we've observed. I have removed the IP address in the curl command as it is part of an ongoing federal investigation
Compromised script: https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...
And here's line 525: