Security News > 2021 > May > Rapid7 Source Code Exposed in Codecov Supply Chain Attack

Rapid7 says unauthorized third-party accessed source code, customer data during Codecov supply chain breach.

Enterprise security vendor Rapid7 says it was among the victims of the Codecov software supply chain attack and warned Thursday that data for a subset of its customers was accessed in the breach.

Rapid7, widely known for its tools that automate security assessments, said an internal investigation found that "a small subset of our source code repositories for internal tooling for our MDR service was accessed by an unauthorized party outside of Rapid7."

The supply chain hack on Codecov happened in mid-January and was discovered in the wild by a Codecov customer on the morning of April 1, 2021 when the company said it learned that someone had gained unauthorized access to the Bash Uploader script and modified it without permission, leading to exposed sensitive secrets like tokens, keys and credentials from organizations around the world.

A small subset of our source code repositories for internal tooling for our MDR service was accessed by an unauthorized party outside of Rapid7.

The massive blast radius from the Codecov supply chain attack remains shrouded in mystery as security teams continue to assess the fallout from the breach but victims continue to publicly acknowledge possible exposure of sensitive developer secrets.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/2CY6iDfrNfo/rapid7-source-code-exposed-codecov-supply-chain-attack