GitHub Actions Attack Pattern Evades CI Scanners

Novee Security disclosed Cordyceps, a CI/CD weakness affecting 300+ repositories from Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. The attack exploits pull_request_target and workflow_run in GitHub Actions, using command injection, code injection, and cross-workflow privilege escalation. Scanners stay green because no single workflow file is wrong.