Coder's Registry Infrastructure Compromised to Push Malicious Terraform Modules

Open-source cloud-development platform Coder disclosed that an unidentified actor compromised its Cloudflare infrastructure and pinned unauthorised servers into the routing pool behind its Terraform module registry, delivering credential-stealing code to a subset of workspace users.

Assessment

The attack targeted the trust boundary of code distribution rather than the registry's application logic. By adding unauthorised IP addresses to the pool behind registry.coder.com (CVE-2026-82416 family, advisory GHSA-vx42-ghc9-gw65), the actor caused Cloudflare to route some registry requests to attacker-controlled infrastructure during a window of 07:35–21:45 UTC on 31 August. The malicious modules searched provisioner environment variables, cloud and AI-tooling API keys, CI/CD credentials, OIDC tokens, configured SSH keys and config-file secrets, then exfiltrated them to the lookalike domain coder-infra[.]com.

Coder fixed the issue in versions 2.37.0, 2.36.4, 2.35.7 and 2.34.9, and states refresh tokens were not passed to the provisioner, with no evidence of impact to its own customer data. Because the adversarial module cache can persist and provisioner secrets may already have been harvested, affected users are advised to rotate the listed secrets, purge module caches, and review firewall, DNS and VPC logs for connections to coder-infra[.]com.

The incident is a direct Australian concern: the digest flags that Australian teams self-hosting Coder or sourcing Terraform modules were inside the exposure window, and the module cache should be purged and provisioner secrets rotated regardless of the per-customer ambiguity. It also reinforces a broader supply-chain lesson — that infrastructure sitting behind a CDN such as Cloudflare is not automatically secure when the attack surface exists in front of the CDN's routing decision. Australian developers should treat artifact and module provenance as a first-class control in their build and deployment pipelines.

Sources: BleepingComputer — https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/