Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks

Novee Security identified a critical exploitable CI/CD workflow pattern, codenamed Cordyceps. A scan of approximately 30,000 high-impact repositories found more than 300 to be fully exploitable. The weakness may allow an unauthenticated user to hijack workflows, execute attacker-controlled code, steal credentials, and compromise software supply chains.