Hackers Hijack Coder Module Registry to Distribute Credential-Stealing Malicious Packages

Coder has reported a significant software supply chain incident in which an unidentified threat actor redirected part of its official module registry traffic to attacker-controlled infrastructure.

This led to the temporary distribution of tampered Terraform modules intended to steal credentials.

The incident affected the registry at registry.coder.com on August 31, 2026, between 07:35 UTC and 21:45 UTC.

Coder stated that the attacker gained access to its Cloudflare infrastructure, reportedly via a compromised API key, enabling them to add unauthorized IP addresses to the registry’s origin pool.

Consequently, some user requests were routed to a rogue server rather than to Coder-controlled infrastructure.

Malicious Terraform Modules Distributed

The attacker-controlled registry hosted altered versions of Coder artifacts containing code intended to harvest credentials.

These malicious modules were engineered to uncover secrets within Terraform provisioning environments and exfiltrate them to coder-infra[.]com, a lookalike domain that mimicked legitimate Coder infrastructure.

Coder confirmed that it has removed the malicious IP addresses, cleared its cache, and ensured that the registry is now clean.

This attack represents a high-impact breach of a trusted software delivery channel. Instead of requiring victims to download a suspicious package from an unknown source, the threat actors exploited an official registry domain commonly used in Coder workspace templates.

Consequently, affected deployments could inadvertently retrieve the malicious modules during standard template imports, updates, dry runs, or workspace provisioning events, especially when Terraform module caching was disabled.

According to Coder’s advisory, the malicious artifacts included files named `dlp.sh` and `dlp-docker.sh`. The injected Terraform code utilized an external data source block, data.external.telemetry, to invoke `dlp-docker.sh`, enabling the payload to execute during provisioning workflows.

The level of exposure depended on when the compromised module was executed. During template uploads, updates, and dry runs, the provisioner could accidentally expose environment variables and secrets available locally on the provisioner host.

These may include cloud API keys, credentials for AI tooling, CI/CD tokens, secrets stored in configuration files, and sensitive commands saved in terminal history.

A workspace build posed an even greater risk, as additional user-linked secrets could be passed to the provisioner. Coder identified potentially exposed data, including user OIDC tokens, configured SSH keys, and one-time external authentication tokens, although refresh tokens were not included.

Deployments that operate provisioners within the `coderd` process, rather than as separate services, may also have exposed Coder configuration variables and database passwords.

Coder stated that it has no evidence that customer data maintained directly by the company was compromised. However, because the malicious servers communicated directly with affected customer deployments, Coder cannot conclusively determine which organizations were impacted.

Indicators of Compromise

Security teams should investigate outbound activity associated with the following indicators:

Indicator type	Value
Exfiltration domain	coder-infra[.]com
Related subdomain	www[.]coder-infra[.]com
Malicious IP address	199.91.220[.]205
Observed URL	http://www[.]coder-infra[.]com/cli/check
HTTP header	X-CLI-Token: your-secret-token

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

The rogue domain was reportedly registered on August 28, just days before the registry compromise.

Organizations utilizing Coder’s public module registry should review firewall, DNS, proxy, and VPC flow logs for connections to coder-infra[.]com.

They need to inspect Coder templates and workspace builds created during the identified timeframe, including template imports and dry-run jobs.

Coder has released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. Administrators should clear any potentially affected cached Terraform modules before upgrading. Simply updating does not remove a malicious artifact retained in the deployment cache.

Lastly, teams should rotate all credentials accessible to exposed provisioners, prioritizing cloud access keys, CI/CD secrets, AI platform API tokens, database passwords, SSH keys, and identity tokens.

In supply-chain incidents, it is crucial to assume that any secret available to the malicious module may have been compromised, even if no suspicious outbound connection is immediately detected.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.