The CI/CD workflow weakness affects Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and Python Software Foundation's Black.
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows
Summary + source link. No paywalls, no tracking.