Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Novee Security disclosed "Cordyceps," a critical CI/CD workflow misconfiguration pattern that allows unauthenticated users to hijack pull-request-triggered workflows to run arbitrary code, exfiltrate credentials, and compromise software supply chains; scans of ~30,000 repositories found over 300 fully exploitable projects affecting major organizations (Microsoft, Google, Apache, Cloudflare), with several vendors confirming impact and applying mitigations after responsible disclosure.