'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows

Novee security researcher Elad Meged disclosed a class of CI/CD workflow weaknesses named “Cordyceps” in which attacker-controlled pull requests can run code in CI environments, steal high-privilege credentials (signing keys, tokens), publish malicious packages, and otherwise compromise software supply chains; Novee flagged 654 potentially vulnerable repositories (300 confirmed fully exploitable) and vendors including Microsoft and Google validated or mitigated impacts, prompting recommendations to inventory and harden workflows and treat workflow YAML as code.