Attackers modified Codecov's Bash uploader script to exfiltrate environment variables (secrets, tokens) from customers' CI pipelines.
A widely-used CI tool; the tampered script ran in thousands of build pipelines for months before detection.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.