Attackers compromised Coder’s Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code.
The Coder platform enables organizations to provide developers with secure, self-hosted cloud development environments for building and deploying software, including AI applications.
The project is used by prominent private and government organizations, including Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government, and defense companies.
Earlier this week, Coder disclosed that an attacker targeted registry.coder.com, the project’s package-hosting site that developers use to source components for their workspace templates.
Although Coder’s registry runs behind Cloudflare, the attacker accessed its underlying infrastructure and added unauthorized servers to the registry’s pool.
As a result, Cloudflare routed some registry requests to the attacker’s servers, instead of Coder’s legitimate servers, delivering malicious files to a subset of users.
“An unidentified malicious actor gained access to Coder’s Cloudflare infrastructure and added unauthorized IP addresses to the pool used for Coder’s module registry,” reads Coder’s advisory.
“These unauthorized IP addresses hosted a version of Coder’s registry that contained artifacts which included malicious code.”
The project said that the delivery window for the malicious artifacts was between 07:35 UTC and 21:45 UTC on Monday, August 31.
During this time, the malicious servers delivered modified versions of Terraform modules, which are ready-made bundles of instructions for creating and configuring computing infrastructure.
According to Coder, the malicious modules acted as information stealers on infected hosts, searching for:
- Provisioner environment variables and secrets
- Cloud infrastructure and AI-tooling API keys
- CI/CD credentials
- Configuration-file secrets and terminal history
- User OIDC tokens
- Configured SSH keys
- One-time external authentication tokens
- Coder database passwords and other configuration secrets when the provisioner ran within ‘coderd’
The collected information was exfiltrated to the lookalike domain ‘coder-infra[.]com.’
It is recommended that potentially impacted users rotate all impacted secrets mentioned in the above list as soon as possible.
Before upgrading to a patched release, versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, Coder recommends that users examine firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com.
Developers should also search provisioner logs for data.external.telemetry, identify modules downloaded during the exposure window, and purge potentially malicious cached packages.
To help users determine if they were impacted, Coder shared an SQL query that can identify potentially affected cached modules and template versions.
The project said refresh tokens were not passed to the provisioner and that there was no evidence of any impact to customer data it maintained.
However, because the attacker’s infrastructure is outside the project’s control, Coder does not have access to crucial logs and cannot conclusively identify every compromised deployment.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
