# Coder Registry Compromise Pushes Malicious Terraform Modules

> Attackers compromised Coder's Cloudflare infrastructure, delivering malicious Terraform modules that stole credentials from users of the development platform.

- Published: 2026-09-07T01:52:41.000Z
- Severity: high
- Category: Supply Chain
- Tags: Supply Chain Attack, Credential Theft, Cloudflare, Coder, Terraform
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/
- Canonical: https://runtimerebel.com/blog/coder-registry-compromise-pushes-malicious-terraform-modules

## Key points

- Immediate impact: Coder users provisioning environments may have received malicious Terraform modules stealing sensitive credentials.
- Affected systems: Coder versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 during a specific exposure window.
- Remediation: Rotate potentially impacted secrets and examine logs for connections to coder-infra[.]com.

A significant supply chain incident impacted Coder, a platform widely used by organizations including Dropbox, Palantir, Square, and U.S. government entities to provide self-hosted cloud development environments. Attackers successfully compromised Coder’s Cloudflare infrastructure, leading to the distribution of malicious Terraform modules designed for [credential theft](/glossary#credential-theft). This compromise highlights the critical vulnerabilities that can arise within development tooling supply chains.

## Technical Details of the Coder Registry Compromise

### [Attack Vector](/glossary#attack-vector) and Modus Operandi
According to [Coder's advisory](https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/), an unidentified malicious actor gained access to Coder’s Cloudflare infrastructure. This access allowed the attacker to add unauthorized IP addresses to the pool used for Coder’s module registry (`registry.coder.com`). Consequently, during a specific exposure window between 07:35 UTC and 21:45 UTC on Monday, August 31, Cloudflare routed some registry requests to these unauthorized, malicious servers instead of Coder’s legitimate infrastructure. This method enabled the attackers to deliver modified versions of Terraform modules to a subset of users. The successful manipulation of the underlying infrastructure demonstrates a sophisticated attack targeting a crucial component of the software development lifecycle.

### Impacted Modules and [Data Exfiltration](/glossary#data-exfiltration)
The malicious Terraform modules were designed to act as information stealers. Once executed on an infected host, these modules searched for a range of sensitive information, including AWS credentials (access key ID, secret access key, session token), GCP credentials (JSON key files), GitHub personal access tokens, and [SSH](/glossary#secure-shell-ssh) private keys. The stolen data was then exfiltrated to a lookalike domain, `coder-infra[.]com`. While Coder stated that refresh tokens were not passed to the provisioner and found no evidence of impact to customer data it maintained, the attacker's control over the exfiltration infrastructure means Coder cannot definitively identify every compromised deployment.

Users of Coder versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 who downloaded or refreshed modules during the exposure window are potentially impacted. The **impact of Coder [supply chain attack](/glossary#supply-chain-attack)** could be severe for affected organizations, leading to unauthorized access to cloud resources, code repositories, and other critical infrastructure via stolen credentials.

## Actionable Recommendations for Coder Users

To mitigate the risks posed by this **Coder registry compromise remediation**, security professionals must act swiftly:

*   **Rotate All Impacted Secrets**: Immediately rotate any AWS credentials, GCP credentials, GitHub personal access tokens, and SSH private keys that might have been present on systems that provisioned Coder workspaces during the exposure window. Assume compromise for these types of credentials.
*   **Examine Logs for Malicious Connections**: Review [firewall](/glossary#firewall), proxy, DNS, and VPC flow logs for any connections to the exfiltration domain `coder-infra[.]com`. This is a primary indicator of potential compromise and can help **detect malicious Terraform modules** in use within your environment.
*   **Search Provisioner Logs**: Inspect provisioner logs for entries containing `data.external.telemetry`. This specific string can help identify modules downloaded during the exposure window that may have been malicious.
*   **Purge Cached Packages**: Identify and purge potentially malicious cached packages that were downloaded during the identified exposure period. This prevents future use of compromised artifacts.
*   **Utilize Coder's SQL Query**: Coder has provided an SQL query to help users identify potentially affected cached modules and template versions. Deploying this query is crucial for a thorough internal assessment.
*   **Upgrade Coder Instances**: Upgrade to a patched release of Coder as soon as possible to ensure that your infrastructure is using trusted registry configurations.

**Related:** [Fake Paysafe/Skrill SDKs on npm & PyPI Steal Credentials](/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentials), [VS Code Marketplace Abuse: Detecting Malicious Developer Extensions](/blog/vs-code-marketplace-abuse-detecting-malicious-developer-extensions)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/coder-registry-compromise-pushes-malicious-terraform-modules