Tuesday 15 September 2026
Evening EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Security

Coder's Cloudflare Infrastructure Breached in Supply Chain Attack on Terraform Modules

Malicious registry servers delivered credential-stealing code to developers using the platform

edit
By LineZotpaper
Published
Read Time2 min
Attackers compromised Coder's Cloudflare infrastructure earlier this week, adding unauthorized registry servers that served malicious Terraform modules designed to steal credentials, API keys, and other sensitive data from developers using the platform.

Coder, a platform that provides organizations with secure, self-hosted cloud development environments, disclosed this week that its module registry was targeted in a supply chain attack. The breach affected registry.coder.com, which hosts packages developers use to source components for workspace templates.

The attacker gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool used for the module registry. As a result, Cloudflare routed some registry requests to the attacker's servers rather than Coder's legitimate servers, delivering malicious artifacts to a subset of users.

According to Coder's security advisory, the delivery window for the malicious artifacts was between 07:35 UTC and 21:45 UTC on Monday, August 31. During this time, the attackers served modified versions of Terraform modules, which are ready-made bundles of instructions for creating and configuring computing infrastructure.

The malicious modules acted as information stealers, searching for a wide range of sensitive data: provisioner environment variables and secrets, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets, terminal history, user OIDC tokens, configured SSH keys, one-time external authentication tokens, and Coder database passwords. The collected information was exfiltrated to the lookalike domain 'coder-infra[.]com.'

Coder recommends that potentially impacted users rotate all compromised secrets immediately. Before upgrading to a patched release (versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9), Coder advises users to examine firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com. Developers should also search provisioner logs for data.external.telemetry, identify modules downloaded during the exposure window, and purge potentially malicious cached packages.

The project said refresh tokens were not passed to the provisioner and that there was no evidence of impact to customer data it maintained. Coder is used by prominent private and government organizations, including Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government, and defense companies.

§

Analysis

Why This Matters

  • Supply chain attacks like this can compromise organizations downstream, as developers who trust the platform may inadvertently deploy malicious code.
  • The breach targeted Terraform modules, which are used to provision infrastructure — giving attackers potential access to cloud environments, CI/CD pipelines, and sensitive credentials.
  • Coder's use by government and defense organizations raises the stakes for national security and data protection.

Background

Coder provides a platform for cloud development environments, allowing organizations to create and manage workspaces for software development, including AI applications. It uses a module registry similar to package managers like npm or PyPI, where developers can download pre-built components. Supply chain attacks on such registries have become a growing concern in the cybersecurity community, as they can have widespread impact through trusted distribution channels.

Key Perspectives

Coder: The company acted quickly to disclose the breach, provided detailed remediation steps, and released patched versions. They emphasized that no customer data maintained by Coder was impacted. Affected Users: Organizations using Coder's registry during the exposure window may have had sensitive credentials stolen, requiring immediate rotation and forensic analysis. Cybersecurity Experts: The attack highlights the risks of relying on third-party infrastructure like Cloudflare, and the importance of verifying the integrity of downloaded modules, even from trusted sources.

What to Watch

  • Whether Coder releases a post-incident report detailing how the Cloudflare infrastructure was compromised.
  • Potential legal or regulatory consequences, especially given Coder's use by government agencies.
  • Any reports of actual exploitation of stolen credentials leading to further breaches.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe