Attackers modified Codecov's Bash uploader script to exfiltrate environment variables (secrets, tokens) from customers' CI pipelines.
A widely-used CI tool; the tampered script ran in thousands of build pipelines for months before detection.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.