I'm not that familiar with codecov but it seems to me way worse then that. The "bash uploader" that was compromised is designed to curl and run a script on cod

I'm not that familiar with codecov but it seems to me way worse then that. The "bash uploader" that was compromised is designed to curl and run a script on codecov's server. This script was compromised to in turn silently run a script from the attacker's server. This could have done anything but I doubt they just dumped ENV, probably opened a reverse shell to literally do anything they want as the user that originally invoked the script. This could be anything from stealing ~/.kube/config and ~/.ssh/id_rsa... If one of the 29,000 customers invoked as root it could be even worse, such as adding users and compromising entire platforms.