Coder's registry infrastructure compromised to push malicious modules

An attacker gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool serving Coder's Terraform module registry. This caused some registry requests to be routed to attacker-controlled servers that delivered malicious Terraform modules containing credential-stealing code. The malicious modules searched for various secrets including environment variables, API keys, CI/CD credentials, tokens, SSH keys, and database passwords when run within Coder's provisioner environment. The stolen information was sent to the domain 'coder-infra[.]com'. The attack window was limited to a single day on August 31, 2026. Coder advises affected users to rotate secrets, review logs for suspicious activity, and purge malicious cached modules. There is no evidence that Coder's customer data was accessed, but the attacker-controlled infrastructure limits full visibility.

The compromise allowed attackers to distribute malicious Terraform modules that acted as information stealers, potentially exposing sensitive credentials and secrets used in cloud infrastructure and development environments. This could lead to unauthorized access to cloud resources, CI/CD pipelines, and other sensitive systems if stolen credentials are reused. However, Coder reports no evidence of direct impact to customer data stored by the platform. The attack was limited in time and scope but may have affected a subset of users who downloaded modules during the delivery window.

Coder has released patched versions (2.37.0, 2.36.4, 2.35.7, and 2.34.9) that address the issue. Users should upgrade to one of these versions. Before upgrading, users should examine firewall, proxy, DNS, and VPC flow logs for connections to the malicious domain 'coder-infra[.]com'. Provisioner logs should be searched for telemetry data indicating malicious activity. Users should identify modules downloaded during the exposure window and purge any potentially malicious cached packages. All potentially impacted secrets—including environment variables, API keys, tokens, SSH keys, and passwords—should be rotated immediately. Coder provides an SQL query to help identify affected cached modules and template versions. There is no indication that refresh tokens were passed to the provisioner, and no evidence of customer data compromise was found.