Cordyceps CI/CD Flaws Let Attackers Hijack 300+ GitHub Repos

Researchers at Novee Security discovered a critical CI/CD workflow weakness, dubbed Cordyceps, affecting over 300 GitHub repositories. The flaw allows attackers to gain full control of workflows at major organizations including Microsoft, Google, and Apache. This enables supply-chain attacks by injecting malicious code into open-source projects.