A Coder registry hijack exposed some users to credential-stealing Terraform modules after an unidentified attacker added unauthorized servers to infrastructure behind registry.coder.com. Coder rated the incident critical, while BleepingComputer reported the disclosure on September 3. The malicious artifacts were served to a subset of requests between 07:35 UTC and 21:45 UTC on August 31.

Coder provides self-hosted cloud development environments and uses its registry to distribute modules for workspace templates. According to the vendor advisory, the intruder gained access to Coder's Cloudflare infrastructure and inserted unauthorized IP addresses into the registry server pool. Cloudflare consequently routed some legitimate-domain requests to attacker-controlled systems.

The modified modules searched provisioner environments for cloud and AI API keys, CI/CD credentials, configuration secrets, terminal history, SSH keys and user OIDC tokens, Coder said. In some deployments, Coder database passwords and external-auth configuration could also have been exposed. The malware sent collected information to the lookalike domain coder-infra[.]com.

Coder said exposure depended on activity during the 14-hour delivery window. Potentially affected actions included creating or updating a workspace template, running a template dry run, or deploying a workspace when module caching was disabled. Because the malicious server was outside Coder's control, the company said it cannot conclusively determine every affected deployment and has no indication that customer data maintained by Coder was affected.

Administrators should examine firewall, proxy, DNS and VPC flow logs for traffic to coder-infra[.]com and search provisioner logs for data.external.telemetry. Coder also supplied SQL queries to identify cached modules and template versions downloaded during the window. Potentially malicious cached packages should be purged before systems are updated.

Coder lists 2.37.0, 2.36.4, 2.35.7 and 2.34.9 as patched versions and says the currently served templates have been reviewed. Organizations that may have downloaded affected modules should rotate credentials accessible to workspace provisioners, including cloud, AI and CI/CD secrets, then review the vendor's published file hashes and network indicators for evidence of compromise.