Cordyceps Supply chain Vulnerability Impacting Code Repositories at thousands of Organizations

Cordyceps is a class of CI/CD supply-chain vulnerabilities in Git-based workflows (not a single bug) where benign-looking workflow steps can pass untrusted data across trust boundaries, enabling command injection, cross-workflow privilege escalation, credential exfiltration, and artifact poisoning. Novee's large-scale scan found hundreds of instances and validated exploit chains against high-profile projects (Microsoft, Google, Apache, Cloudflare, Python Software Foundation), demonstrating wide-scale impact and the need to treat workflows as first-class code with least-privilege controls and end-to-end attack validation.