Hackers Hijack Coder Registry, Injecting Malicious Terraform Modules to Steal Cloud Credentials
An unidentified threat actor compromised Coder's Terraform module registry, redirecting traffic to malicious servers and injecting credential-stealing code into Terraform modules.
A significant security incident has impacted users of Coder's Terraform module registry, following a compromise that allowed an unidentified threat actor to inject malicious code into Terraform modules. The attack, which occurred on August 31, 2026, involved unauthorized modifications to Coder's Cloudflare infrastructure, enabling the redirection of some registry traffic to attacker-controlled servers. These rogue servers then hosted modified Terraform artifacts containing credential-stealing malware.
The affected service was Coder's primary registry, registry.coder.com, a critical resource for workspace templates and modules. The malicious packages were accessible for a period of approximately 14 hours, between 07:35 UTC and 21:45 UTC on August 31, 2026. Organizations that interacted with the registry during this window—by creating new templates, updating existing ones, or performing dry runs—may have been exposed. During this time, Terraform module caching was also disabled, potentially increasing the risk of direct exposure.
The injected malware was designed to target sensitive secrets available within the Terraform provisioner environment. Coder's security advisory detailed that the malware attempted to identify and exfiltrate cloud credentials and sensitive environment variables to a lookalike domain, coder-infra[.]com. This domain was crafted to mimic legitimate Coder infrastructure, a tactic intended to evade detection during routine log reviews.
Technical analysis revealed that the malicious Terraform modules utilized a data.external.telemetry block to execute a script named dlp-docker.sh. This script communicated with the attacker-controlled endpoint at www[.]coder-infra[.]com/cli/check, transmitting data via an X-CLI-Token HTTP header. The IP address 199.91.220[.]205 was identified as being associated with this malicious activity.
The potential impact varied depending on the specific actions taken by users. During template imports and updates, the primary risk involved the exposure of environment variables and secrets present on the provisioner host. In a workspace build scenario, the malicious code could also access temporary user secrets provided to the provisioner, such as OIDC tokens, SSH keys, and external authentication tokens. For organizations running the provisioner within the main Coder service, the exposure could be more extensive, potentially including Coder configuration values, database credentials, and other application secrets.
Coder has since released patched versions of its software, including 2.37.0, 2.36.4, 2.35.7, and 2.34.9. Users running versions prior to 2.37.0 are strongly advised to remove any potentially compromised modules from their local cache and update to a patched version. Coder has also stated that there is no indication that customer data maintained by the company was directly affected by this incident.
Security teams are urged to review their Coder deployment logs for module downloads within the affected timeframe. They should also scrutinize DNS, firewall, proxy, and VPC flow logs for any connections to coder-infra[.]com and inspect provisioner logs for the presence of the data.external.telemetry string. A comprehensive remediation strategy includes rotating all credentials that may have been exposed, such as cloud API keys, CI/CD secrets, AI tooling tokens, SSH keys, and any secrets stored in environment variables or terminal history.
This incident underscores the persistent supply-chain risks inherent in infrastructure-as-code workflows. It serves as a stark reminder that even trusted repositories can become vectors for credential theft when the underlying infrastructure for traffic routing or package distribution is compromised.