Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed to steal cloud credentials, SSH keys, CI/CD secrets, and other sensitive data.
The malicious modules were delivered for roughly 14 hours on August 31, from 07:35 to 21:45 UTC. Coder says it has found no evidence that customer data it maintains was affected, but it cannot conclusively identify every compromised deployment.
Attackers hijacked Coder’s trusted registry path
According to Coder, an unidentified attacker gained access to its Cloudflare infrastructure and added unauthorized IP addresses to the pool serving registry.coder.com.
Cloudflare then routed some legitimate registry requests to attacker-controlled servers. Those servers hosted modified versions of Coder Terraform modules containing credential-stealing code.
The attack did not exploit a vulnerability in Terraform itself. Instead, it compromised a trusted software delivery path, allowing malicious artifacts to arrive through Coder’s legitimate registry hostname.
The initial method used to gain access to Coder’s Cloudflare environment has not been disclosed.
Once delivered, the malicious modules searched provisioner environments for cloud and AI-tooling API keys, CI/CD credentials, configuration-file secrets, terminal history, OIDC tokens, SSH keys, one-time authentication tokens, and other sensitive data.
If a provisioner ran inside coderd, the malware could also access Coder database passwords and other configuration secrets.
Stolen information was exfiltrated to the lookalike domain coder-infra[.]com.
Terraform modules could execute credential-stealing code
Coder tells customers to search provisioner logs for data.external.telemetry, which identifies a Terraform external data source used by the malicious modules.
Terraform’s external data source can execute an external program and passes environment variables visible to Terraform into that child process. HashiCorp’s documentation describes the feature as an “escape hatch” for cases where a normal provider is not suitable.
That gave the malicious module a valuable position: code running during infrastructure provisioning could access the same cloud credentials, tokens, and configuration data available to the provisioning process.
The incident also exposes a gap between Terraform’s protections for providers and modules.
Terraform’s .terraform.lock.hcl file records provider selections and cryptographic hashes, but HashiCorp says the lock file does not currently track remote modules.
An exact module version constraint can ensure Terraform selects the same version number, but it does not independently verify that a compromised registry is serving the original contents associated with that version.
That distinction is especially relevant here because the registry delivery path itself was compromised.
The incident follows other recent software supply chain attacks targeting developer infrastructure, where trusted packages or development tools became paths to credentials and cloud environments.
Coder recommends hunting and credential rotation
Coder recommends checking firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com before clearing potentially useful evidence.
Organizations should also search provisioner logs for data.external.telemetry, identify modules downloaded during the August 31 exposure window, and use Coder’s published SQL query to identify potentially affected cached modules and template versions.
Potentially affected organizations should rotate any credentials accessible to provisioners during the incident, including:
- Cloud and AI-tooling API keys
- CI/CD credentials
- OIDC and one-time authentication tokens
- SSH keys
- Database passwords where applicable
Credential rotation is particularly important because exposed cloud access keys can remain usable even after the original compromise has been contained.
Coder also recommends clearing affected cached packages and upgrading to one of the patched releases:
- 2.37.0
- 2.36.4
- 2.35.7
- 2.34.9
Refresh tokens were not passed to provisioners, according to Coder.
Scope of the compromise remains uncertain
Coder says it cannot conclusively determine every affected deployment because key logs are held on attacker-controlled infrastructure.
The company has not disclosed how the attacker initially gained access to its Cloudflare environment or attributed the activity to a known threat actor.
The incident adds to growing concern around developer tools as part of the software supply chain attack surface. Registries, CI/CD systems, coding tools, and infrastructure automation can all hold credentials with access far beyond the developer workstation itself.
Organizations that used Coder during the August 31 exposure window should therefore treat patching, investigation, and credential rotation as separate remediation steps. Updating Coder removes the compromised delivery path, but it cannot invalidate secrets that may already have been stolen.
Also read: A compromised GitHub account helped spread the Shai-Hulud npm supply chain attack, distributing credential-stealing malware across hundreds of packages.