Cordyceps: The Silent Parasite Consuming Your Supply Chain
Novee’s research team discovered Cordyceps, a critical supply chain flaw hiding in plain sight, impacting code repositories at thousands of organizations, including Microsoft, Google, Apache, and Cloudflare.
June 23, 2026
Novee identified a systemic class of exploitable CI/CD vulnerabilities across the open-source supply chain – command injection, broken authentication logic, artifact poisoning chains, and privilege escalation in GitHub Actions workflows.
Our team scanned roughly 30,000 high-impact repositories, validated hundreds of fully exploitable attack chains, and received confirmation of fixes at dozens of organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. There are millions of repositories that are potentially affected by this same pattern.
The nature of agentic coding means these CI/CD vulnerabilities are reproduced persistently, at scale, “infecting” repositories at an exponential rate. Because anonymous users can use them to gain control over the software supply chain, we like to think of it as “puppeteering” the repositories of some of the world’s biggest companies, silently manipulating their workflows.
Key Takeaways
- Novee found a critical exploitable pattern in the software supply chain – which we’re calling Cordyceps – allowing for workflow hijack and full attacker control of repositories at dozens of the world’s largest companies.
- The flaw is exploitable by any unauthenticated user. No org membership or special privileges; a free account is enough to forge approvals, push code, or steal credentials.
- Once the exploit pattern was identified, 654 repositories were flagged in a single scan, and more than 300 were confirmed fully exploitable – attacker-controlled code execution, credential theft, or outright supply chain compromise.
- AI coding agents are scaling the problem. They generate CI/CD configuration fast and reproduce the same insecure patterns over and over.
Example Findings
Microsoft > Azure Sentinel
A comment on a pull request runs anonymous attacker code on Microsoft’s CI and steals a non-expiring GitHub App key. At stake: Persistent write access to the security content Microsoft ships to customers via Azure Marketplace Content Hub.
Google > AI Agent Development Kit (adk-samples)
A single pull request runs attacker code in Google’s CI and gains authenticated control over the associated Google Cloud project with roles/owner. The official ADK sample repository has 9,200+ stars.
Apache > Doris
Two independent zero-click attacks: (1) A comment on any pull request exfiltrates hardcoded CI credentials; (2) A fork PR steals a token with full write permissions across actions, contents, packages, and pages.
Cloudflare > Workers SDK
A pull request with a crafted branch name executed arbitrary commands on Cloudflare’s CI runners. Cloudflare credited Novee and applied broad hardening.
Python Software Foundation – Black
A single pull request from anyone could run attacker code on Black’s build systems and steal the automation token, which can approve pull requests as the project’s own bot. Black serves 130 million installs per month.
Vulnerability Classes
| Vulnerability Class | Finding | App-Code Equivalent |
|---|---|---|
| Command Injection | Attacker-controlled input interpolated into shell commands | Unsanitized user input passed to os.system() |
| Code Injection | Attacker-controlled input interpolated into JavaScript (actions/github-script) | Server-side template injection |
| Broken Authorization | Authorization logic exists but fails silently | Broken access control with null-check bug |
| Cross-Workflow Privilege Escalation | Untrusted data from low-privilege workflow crosses into high-privilege workflow | Deserialization chains, confused-deputy attacks |
GitHub Response
On June 18, 2026 — five days before Novee published Cordyceps — GitHub released actions/checkout v7, which blocks the most common patterns by refusing to check out the head of an unreviewed fork pull request inside pull_request_target workflows. On July 16, 2026, GitHub will backport this enforcement logic to all currently supported major versions of the checkout action.
Novee confirmed to Dark Reading that it found no evidence any attacker has applied the Cordyceps pattern broadly at scale prior to the June 23 disclosure. All named organizations patched the identified vulnerabilities before the research was made public.