Attackers compromised Coder's Cloudflare infrastructure to inject unauthorized registry servers into the platform. These rogue servers were used to deliver malicious Terraform modules containing credential-stealing code. The attack represents a supply chain compromise targeting developers using Coder's registry. By hijacking the infrastructure layer rather than the codebase directly, attackers could silently distribute malware to unsuspecting users. The credential-stealing payloads embedded in the Terraform modules pose a significant risk to affected organizations. This incident highlights the growing trend of supply chain attacks targeting developer tooling and infrastructure registries.
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool used for Coder's module registry (registry.coder.com). Cloudflare subsequently routed some registry requests to the attacker-controlled servers instead of Coder's legitimate servers. The malicious servers delivered trojanized Terraform modules — ready-made infrastructure configuration bundles — during the window of 07:35 UTC to 21:45 UTC on August 31. These malicious modules acted as information stealers, collecting: provisioner environment variables and secrets, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets and terminal history, user OIDC tokens, configured SSH keys, one-time external authentication tokens, and Coder database passwords and other configuration secrets when the provisioner ran within 'coderd'. All collected data was exfiltrated to the lookalike domain 'coder-infra[.]com'. The attack vector was manipulation of Cloudflare infrastructure routing rather than a direct compromise of Coder's application code. Refresh tokens were not passed to the provisioner and no evidence of impact to Coder-maintained customer data was found.
1. Upgrade to patched Coder versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9. 2. Immediately rotate all potentially compromised secrets including: provisioner environment variables, cloud and AI-tooling API keys, CI/CD credentials, configuration-file secrets, OIDC tokens, SSH keys, one-time external authentication tokens, and Coder database passwords. 3. Examine firewall, proxy, DNS, and VPC flow logs for any connections to coder-infra[.]com during and after the exposure window (07:35–21:45 UTC, August 31). 4. Search provisioner logs for references to 'data.external.telemetry' to identify potential compromise indicators. 5. Identify all modules downloaded during the exposure window. 6. Purge potentially malicious cached packages. 7. Run the SQL query provided by Coder (referenced in their GitHub advisory GHSA-vx42-ghc9-gw65) to identify potentially affected cached modules and template versions.
coder-infra[.]com (exfiltration domain / lookalike domain), data.external.telemetry (malicious provisioner log identifier)
