Malicious Terraform Modules Steal Cloud Credentials via Cloudflare Infrastructure
Threat actors compromised the Cloudflare infrastructure behind Coder’s module registry and served malicious Terraform modules to developers. Consequently, organizations using the popular self-hosted development platform may have unknowingly installed credential-stealing code into their cloud environments. Coder disclosed the incident on September 3, 2026, and urged all users to rotate secrets immediately.
What Happened: Coder Supply-Chain Attack Targets Cloudflare Registry Infrastructure
Coder is a widely adopted platform that provides secure, self-hosted cloud development environments. Furthermore, prominent organizations including Dropbox, Palantir, Square, Mercedes-Benz, KKR, and U.S. government agencies rely on Coder for building and deploying software. Earlier this week, the project disclosed that an attacker gained access to its Cloudflare infrastructure and manipulated the registry server pool.
The attacker added unauthorized IP addresses to the pool used for registry.coder.com. Therefore, Cloudflare routed some requests to malicious servers instead of legitimate Coder infrastructure. These rogue servers served modified Terraform modules containing information-stealing code. The delivery window lasted from 07:35 UTC to 21:45 UTC on Monday, August 31, 2026.
According to Coder’s security advisory, the malicious modules acted as information stealers on infected hosts. Also, the stolen data was exfiltrated to the lookalike domain coder-infra[.]com.
Technical Details of the Coder Supply-Chain Attack
The attack exploited the trust boundary between Coder’s registry and its CDN provider. Specifically, the attacker accessed Coder’s Cloudflare configuration and injected unauthorized registry servers into the load-balanced pool. As a result, developers downloading workspace template modules received compromised artifacts.
The malicious Terraform modules searched for and exfiltrated a wide range of sensitive credentials:
- Provisioner environment variables and secrets
- Cloud infrastructure and AI-tooling API keys
- CI/CD credentials
- Configuration-file secrets and terminal history
- User OIDC tokens
- Configured SSH keys
- One-time external authentication tokens
- Coder database passwords and other configuration secrets when the provisioner ran within coderd
Because the attacker controlled the malicious infrastructure, Coder cannot conclusively identify every compromised deployment. Moreover, the project confirmed that refresh tokens were not passed to the provisioner. However, the breadth of credentials at risk remains significant.
Attack Scope and Exposure Window
The exposure was time-bound but impactful. Users who created new workspace templates, updated template versions, ran dry-run template builds, or deployed workspaces with module caching disabled during the August 31 window are at highest risk. Workspace creation with module caching enabled (the default) may also trigger module downloads.
Business and Operational Impact
The Coder supply-chain attack carries serious implications for affected organizations. First, the platform serves major enterprises and government entities. Second, the stolen credentials could enable lateral movement, data exfiltration, or supply-chain contamination downstream.
- Credential exposure: Cloud API keys, CI/CD secrets, and SSH keys grant attackers direct access to production infrastructure.
- Data breach risk: Database passwords and OIDC tokens could expose sensitive customer or proprietary data.
- Compliance implications: Organizations under SOC 2, FedRAMP, or GDPR may face audit findings if compromised modules accessed regulated data.
- Reputational damage: Trust in the Coder platform and its supply chain may erode among enterprise customers.
- Downstream contamination: Stolen CI/CD credentials could be used to inject malicious code into customer software builds.
Additionally, because the attacker infrastructure is outside Coder’s control, forensic visibility is limited. Organizations must therefore conduct their own investigations.
Mitigation and Recommendations
Coder released patched versions and published SQL queries to help identify impacted deployments. Furthermore, the project validated that currently served templates are clean.
Immediate Actions for Defenders
- Review firewall, proxy, DNS, and VPC flow logs for outbound connections to coder-infra[.]com.
- Search provisioner logs for the sentinel string data.external.telemetry.
- Run Coder’s provided SQL queries against your deployment to identify cached modules fetched during the exposure window.
- Purge any potentially malicious cached packages from your infrastructure before performing fresh deployments.
- Update to patched versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9.
Credential Rotation
Proactively rotate all potentially impacted secrets. Specifically, rotate cloud API keys, CI/CD credentials, SSH keys, OIDC tokens, and database passwords. Also, revoke any one-time external authentication tokens that may have been exposed.
Bottom line: If your organization uses Coder and pulled registry modules on August 31, assume compromise until proven otherwise. Rotate every secret the malicious modules could access, audit your logs, and apply patches immediately. Supply-chain attacks exploit trust at the infrastructure layer, and recovery demands swift, thorough action.
Incident Summary
| Incident ID: | GHSA-vx42-ghc9-gw65 |
| Affected Platform: | Coder self-hosted development environments (registry.coder.com) |
| Disclosure Date: | September 3, 2026 |
| Exposure Window: | August 31, 2026, 07:35 UTC – 21:45 UTC |
| Attack Vector: | Cloudflare infrastructure compromise, unauthorized registry servers |
| Malicious Payload: | Terraform modules with credential-stealing code |
| Exfiltration Domain: | coder-infra[.]com |
| Patch Status: | Patched versions available: 2.37.0, 2.36.4, 2.35.7, 2.34.9 |
| Severity: | Critical — widespread credential exposure risk |
References
- BleepingComputer, “Coder’s registry infrastructure compromised to push malicious modules,” September 3, 2026, https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/, accessed September 4, 2026.
- Coder Security Advisory, “Malicious Packages Served from Unauthorized Registry Server,” GitHub, September 3, 2026, https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65, accessed September 4, 2026.
