Researchers have identified a new class of CI/CD workflow weakness, dubbed ‘Cordyceps,’ that allows attackers to hijack workflows and compromise open-source supply chains. This critical exploitable pattern affects hundreds of GitHub repositories from major organizations like Microsoft, Google, and Apache. The flaw can grant attackers full control over repositories, posing a significant risk to the software supply chain.