CI/CD pipeline abuse: the problem no one is watching

This report documents the growing threat to CI/CD pipelines, describing real incidents and campaigns that use modified workflows and stolen developer credentials to exfiltrate secrets, pivot to cloud/production, and poison supply chains; it introduces and validates cicd-abuse-detector, an open-source CI workflow that extracts regex-based signals and uses LLM analysis to detect malicious pipeline changes across GitHub Actions, GitLab CI, and Azure DevOps, and provides detection examples, mapped MITRE techniques, and hardening recommendations.