investigating the codecov 29k vulnerability