A significant supply chain incident impacted Coder, a platform widely used by organizations including Dropbox, Palantir, Square, and U.S. government entities to provide self-hosted cloud development environments. Attackers successfully compromised Coder’s Cloudflare infrastructure, leading to the distribution of malicious Terraform modules designed for credential theft. This compromise highlights the critical vulnerabilities that can arise within development tooling supply chains.
Technical Details of the Coder Registry Compromise
Attack Vector and Modus Operandi
According to Coder’s advisory, an unidentified malicious actor gained access to Coder’s Cloudflare infrastructure. This access allowed the attacker to add unauthorized IP addresses to the pool used for Coder’s module registry (registry.coder.com). Consequently, during a specific exposure window between 07:35 UTC and 21:45 UTC on Monday, August 31, Cloudflare routed some registry requests to these unauthorized, malicious servers instead of Coder’s legitimate infrastructure. This method enabled the attackers to deliver modified versions of Terraform modules to a subset of users. The successful manipulation of the underlying infrastructure demonstrates a sophisticated attack targeting a crucial component of the software development lifecycle.
Impacted Modules and Data Exfiltration
The malicious Terraform modules were designed to act as information stealers. Once executed on an infected host, these modules searched for a range of sensitive information, including AWS credentials (access key ID, secret access key, session token), GCP credentials (JSON key files), GitHub personal access tokens, and SSH private keys. The stolen data was then exfiltrated to a lookalike domain, coder-infra[.]com. While Coder stated that refresh tokens were not passed to the provisioner and found no evidence of impact to customer data it maintained, the attacker’s control over the exfiltration infrastructure means Coder cannot definitively identify every compromised deployment.
Users of Coder versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 who downloaded or refreshed modules during the exposure window are potentially impacted. The impact of Coder supply chain attack could be severe for affected organizations, leading to unauthorized access to cloud resources, code repositories, and other critical infrastructure via stolen credentials.
Actionable Recommendations for Coder Users
To mitigate the risks posed by this Coder registry compromise remediation, security professionals must act swiftly:
- Rotate All Impacted Secrets: Immediately rotate any AWS credentials, GCP credentials, GitHub personal access tokens, and SSH private keys that might have been present on systems that provisioned Coder workspaces during the exposure window. Assume compromise for these types of credentials.
- Examine Logs for Malicious Connections: Review firewall, proxy, DNS, and VPC flow logs for any connections to the exfiltration domain
coder-infra[.]com. This is a primary indicator of potential compromise and can help detect malicious Terraform modules in use within your environment. - Search Provisioner Logs: Inspect provisioner logs for entries containing
data.external.telemetry. This specific string can help identify modules downloaded during the exposure window that may have been malicious. - Purge Cached Packages: Identify and purge potentially malicious cached packages that were downloaded during the identified exposure period. This prevents future use of compromised artifacts.
- Utilize Coder’s SQL Query: Coder has provided an SQL query to help users identify potentially affected cached modules and template versions. Deploying this query is crucial for a thorough internal assessment.
- Upgrade Coder Instances: Upgrade to a patched release of Coder as soon as possible to ensure that your infrastructure is using trusted registry configurations.
Related: Fake Paysafe/Skrill SDKs on npm & PyPI Steal Credentials, VS Code Marketplace Abuse: Detecting Malicious Developer Extensions