Hackers Hijack Coder's Registry to Deliver Credential-Stealing Terraform Modules
Attackers compromise Coder's Cloudflare infrastructure and add unauthorized servers to the project's module registry, delivering malicious Terraform modules to a subset of users. Coder's registry, registry.coder.com, serves as the package-hosting site where developers source components for workspace templates. Because the attacker gains access to the underlying infrastructure behind Cloudflare, some user requests route to attacker-controlled servers instead of legitimate ones.
The malicious delivery window runs from 07:35 UTC to 21:45 UTC on Monday, August 31. During this period, the compromised servers deliver modified Terraform modules that act as information stealers on infected hosts. The malicious code searches for provisioner environment variables, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets, terminal history, OIDC tokens, SSH keys, and Coder database passwords. It then exfiltrates the collected data to the lookalike domain coder-infra[.]com.
Coder advises all potentially impacted users to rotate the affected secrets as soon as possible. The platform, which provides self-hosted cloud development environments and counts Dropbox, Palantir, Mercedes-Benz, and the U.S. government among its users, urges customers to upgrade to a patched release before versions beyond 2.37.0. The incident underscores the ongoing risk of supply chain attacks targeting developer tooling and package registries.