Cordyceps: The Silent Parasite Consuming Your Supply Chain

2026-06-25

Novee's team identified over 300 exploitable chains in GitHub Actions pipelines across roughly 30,000 prominent open-source repositories, including those used by Microsoft, Google, Apache, and Cloudflare. Attackers can trigger workflows to run arbitrary code, steal long-lived tokens, and push modified artifacts into production, impacting thousands of downstream environments.