Coder has disclosed a critical supply-chain compromise after an unidentified threat actor gained access to its Cloudflare infrastructure and inserted unauthorized IP addresses into the pool serving the company’s module registry.
The intrusion allowed a malicious registry server to distribute trojanized Coder artifacts to a subset of users, potentially exposing cloud, CI/CD, AI tooling, and user authentication credentials.
The incident affected users of the primary Coder module registry, registry.coder.com, who downloaded or updated Terraform-based template components during a limited exposure window on August 31, 2026, between 07:35 UTC and 21:45 UTC.
Hackers Compromise Coder Module Registry
Coder said it has no evidence that customer data maintained by the company was accessed or impacted. The malicious packages contained code designed to discover credentials available in the affected environment and send them to an attacker-controlled lookalike domain, coder-infra[.]com.
The domain closely resembles legitimate Coder infrastructure naming and was reportedly registered on August 28, shortly before the compromise.
The compromised modules used a Terraform data "external" "telemetry" block to execute a malicious script named dlp-docker.sh.
The script was configured to contact http://www[.]coder-infra[.]com/cli/check and transmit data using an X-CLI-Token HTTP header, creating a direct mechanism for harvesting and exfiltrating sensitive deployment data.
Coder warned that the impact depends on when a malicious module executed. During template uploads, updates, or dry runs, the malicious code would generally not receive user-specific secrets.
However, it could still access environment variables and credentials stored on the provisioner host, creating a risk for infrastructure-level secrets.
The greater exposure occurred during workspace builds. In that scenario, a provisioner could receive a user’s OIDC token, an SSH key where configured, and single-use external authentication tokens used by the affected template.
Refresh tokens were not included. Organizations running provisioners within the coderd process rather than as a separate service could face broader exposure.
In those configurations, attacker code may have accessed Coder configuration variables, including database passwords, external authentication-provider settings, and other environment-based secrets.
Affected Versions and Patches
Coder assigned the incident a critical severity rating and published advisory GHSA-vx42-ghc9-gw65. The advisory does not list a CVE identifier, but identifies versions earlier than 2.37.0 as affected. The company released corrected builds in Coder versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9.
Administrators should update their deployments only after removing potentially malicious cached Terraform modules. Installing a patched Coder version alone may not eliminate compromised artifacts already stored in module caches or deployment infrastructure.
The company released SQL queries that can help administrators identify cached module files, associated templates, affected workspaces, and provisioner logs containing the data.external.telemetry indicator.
Security teams should inspect firewall, DNS, proxy, and VPC flow logs for outbound traffic to coder-infra[.]com or the IP address 199.91.220[.]205.
The advisory also identifies several malicious shell-script hashes, including the SHA-256 value 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398 for dlp-docker.sh.
Affected organizations should purge cached modules fetched during the exposure period, redeploy from verified packages, and rotate all credentials that may have been accessible to provisioners.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
