A newly identified class of vulnerabilities in Continuous Integration/Continuous Deployment (CI/CD) workflows, codenamed Cordyceps, poses a significant threat to open-source supply chains, potentially allowing attackers to seize control of over 300 GitHub repositories1. This exploitable pattern, discovered by Novee Security, can grant full control to attackers, compromising the security of repositories belonging to major organizations such as Microsoft, Google, and Apache. The Cordyceps flaw enables hijacking of CI/CD workflows, which can have devastating consequences for the integrity of software development pipelines. As a result, attackers can inject malicious code, steal sensitive data, or disrupt the development process. This vulnerability underscores the importance of securing CI/CD workflows to prevent supply-chain attacks, making it crucial for developers and security teams to take immediate action to mitigate this risk.