Cordyceps flaw lets GitHub strangers hijack CI/CD pipelines and breach supply chains
Novee Security’s Cordyceps pattern shows that an unauthenticated GitHub account can hijack CI/CD workflows, exposing 300+ open‑source projects to supply‑chain compromise. The finding forces teams to treat pipeline YAML as code and audit who can trigger builds, what permissions they hold, and how secrets are exposed.