Supply Chain Under Attack: How "Cordyceps" Could Compromise Microsoft, Google & Cloudflare
Novee Security just uncovered a critical CI/CD vulnerability — codenamed Cordyceps — giving attackers full control over repositories at Microsoft, Google, Apache, and Cloudflare.
No zero-day needed. It exploits legitimate GitHub Actions mechanics.
What Is Cordyceps?
Named after a parasitic fungus that hijacks its host, Cordyceps targets a weakness in how GitHub Actions handles pull_request_target and workflow_run events — triggers that run with elevated permissions even when the code comes from an untrusted external fork.
An attacker submits a pull request that appears completely harmless while silently injecting commands into the CI pipeline. Once the workflow runs, they can:
Steal secrets and API tokens Inject malicious code into production builds Backdoor published packages or container images Poison downstream dependencies used by millions
Why This Matters
1. It hits well-secured organizations. Active security teams, regular audits — none of it helps if a single workflow trigger is misconfigured.
2. The attack is invisible to reviewers. Malicious pull requests look completely legitimate on the surface.
3. The blast radius is massive. One backdoored package from Apache or Cloudflare quietly poisons thousands of downstream projects.
Novee Security confirmed that dozens of major organizations had at least one vulnerable workflow. Notifications and patches are already underway.
Your Immediate Checklist
If your team uses GitHub Actions, act now
Audit all pull_request_target workflows — restrict permissions explicitly Never check out untrusted code in a privileged execution context Pin all Actions to a specific commit SHA, not a mutable tag Enforce mandatory peer review for every change to .github/workflows/ Monitor CI logs for unexpected or anomalous secret access
The Bigger Picture
SolarWinds. XZ Utils. Now Cordyceps.
Attackers are no longer targeting your software — they are going after the infrastructure you use to build and ship it.
Your CI/CD pipeline holds write access to your codebase, your secrets, and your artifacts. Most teams treat it as a convenience. Attackers treat it as a high-value target.
Securing your pipeline means applying the same principles as production: zero trust, least privilege, mandatory review, and continuous monitoring.
Your build system is not a dev tool. It is a privileged attack surface.
Defend it like one.
Share this if your team relies on GitHub Actions — major orgs are still actively patching this.
How does your organization approach CI/CD security today? Let's discuss below.