Coder's registry hijacked to serve booby-trapped Terraform modules

Fourteen hours when the registry was not the registry

On 31 August 2026, between 07:35 and 21:45 UTC, part of the traffic sent to registry.coder.com was not served by Coder. According to the vendor’s advisory, reported on 3 September by Bleeping Computer, an unidentified threat actor gained access to Coder’s Cloudflare infrastructure and added unauthorized IP addresses to the pool used by the module registry. Cloudflare therefore routed a fraction of the requests to servers controlled by the attacker, which hosted a version of the registry containing malicious artifacts.

Coder is the platform an organization uses to give its developers self-hosted cloud development environments, including for building AI applications. Its registry holds the components those teams assemble into workspace templates. Among the organizations relying on the project, Bleeping Computer names Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the US government and companies in the defense sector.

Terraform modules turned into credential stealers

What was distributed during that window were modified versions of Terraform modules — the ready-made sets of instructions that describe how a piece of infrastructure is created and configured. Once executed on the host, they behaved like information-stealing software.

The list of what they went looking for maps closely onto an infrastructure team’s keyring: provisioner environment variables and secrets, cloud infrastructure and AI tooling API keys, CI/CD credentials, secrets from configuration files and terminal history, user OIDC tokens, configured SSH keys, single-use external authentication tokens. When the provisioner was running inside coderd, Coder database passwords and other configuration secrets were added to that haul. The collected data was exfiltrated to a lookalike domain, coder-infra[.]com.

What Coder asks you to check, and in what order

The vendor recommends that potentially affected users rotate every concerned secret as soon as possible. Before moving to a fixed release — 2.37.0, 2.36.4, 2.35.7 or 2.34.9 — it advises reviewing firewall, proxy, DNS and VPC flow logs for connections to coder-infra[.]com.

On the application side, you need to search for data.external.telemetry in provisioner logs, identify the modules downloaded during the exposure window, then purge cached packages that may be malicious. Coder has also published a SQL query that surfaces cached modules and potentially affected template versions.

What the vendor cannot tell you

Coder states that refresh tokens were not passed to the provisioner, and that nothing indicates an impact on the customer data in its care. But it also draws an explicit line: the attacker’s infrastructure is outside its control, it has no access to the logs that would settle the question, and it therefore cannot identify every compromised deployment with certainty.

The inventory of what was downloaded on 31 August can only be built by each team, from its own logs. Until that work is done, the prudent assumption is that the secrets present on those hosts have changed hands.