Attackers Hijacked Coder's Cloudflare Setup to Push Poisoned Terraform Modules
For 14 hours on August 31, some developers pulling from Coder's official registry got credential-stealing code instead of the real thing.
Key points
- Attackers broke into Coder's Cloudflare setup on August 31 and slipped rogue servers into the pool handling requests to registry.coder.com.
- Between 07:35 and 21:45 UTC, some users downloading Terraform modules from the registry got a tampered version carrying credential-stealing code.
- Stolen data was sent to a lookalike domain, coder-infra[.]com, and included cloud API keys, SSH keys, CI/CD credentials, and terminal history.
- Fixed releases are 2.37.0, 2.36.4, 2.35.7 and 2.34.9; Coder says customer data it holds was not touched, but it cannot see the attacker's logs.
- Coder's user base includes Dropbox, Palantir, Square, Mercedes-Benz, the U.S. Government and defence contractors.
Coder, the company behind a popular self-hosted platform that gives software developers ready-made cloud workspaces, has confirmed that criminals hijacked part of its delivery infrastructure and used it to hand out booby-trapped code to a slice of its users.
The incident, first reported by BleepingComputer, ran for about 14 hours on Monday, August 31.
If you've never touched Coder, the short version: big organisations use it so their developers can code inside a controlled cloud environment instead of on their own laptops. Named users include Dropbox, Palantir, Square, Mercedes-Benz, KKR and EnBW, plus U.S. Government and defence outfits. That's the blast radius we're talking about.
What actually happened?
Someone got inside Coder's Cloudflare account, which is the service that sits in front of registry.coder.com and directs traffic to the right backend server. The attacker quietly added their own servers to the pool. Cloudflare, doing what it's told, sent a portion of registry requests to those rogue machines.
Developers asking the registry for Terraform modules (pre-built recipes that tell cloud providers like AWS or Azure how to spin up infrastructure) got poisoned versions back. The malicious modules ran on the developer's machine and quietly rifled through it.
What did the malicious modules steal?
According to Coder's advisory, the modules scraped anything a developer machine tends to have lying around: cloud and AI service API keys, credentials used by build and deployment pipelines (CI/CD), SSH keys, one-time login tokens, secrets sitting in config files, terminal history, and in some cases Coder's own database passwords.
Everything was shipped out to a lookalike domain, coder-infra[.]com, designed to blend in with real Coder traffic.
That grab-bag is enough to pivot into a company's AWS account, its GitHub and its production servers, plus whatever AI tooling the team was wired into.
Timeline and fixed versions
| Item | Detail |
|---|---|
| Malicious delivery window | 07:35 to 21:45 UTC, August 31 |
| Exfiltration domain | coder-infra[.]com |
| Patched versions | 2.37.0, 2.36.4, 2.35.7, 2.34.9 |
| Customer data held by Coder | No evidence of impact |
What should affected teams do now?
Rotate everything the stealer could have grabbed, and do it before upgrading. Cloud keys, CI/CD tokens, SSH keys, OIDC tokens. Admins should check firewall, proxy, DNS flow logs and VPC flow logs for outbound connections to coder-infra[.]com, then hunt through provisioner logs for data.external.telemetry calls made during the 14-hour window. Coder has published a SQL query to identify cached modules and template versions that came from the poisoned pool.
The honest bit in Coder's writeup: because the attacker's servers were never theirs, they don't have the logs. They can't tell every customer whether they were hit. Each affected org has to work that out locally.
The uncomfortable part
The failure mode here isn't a bug in Terraform, or in Cloudflare, or even really in Coder's application code. Someone got into the account that controls where traffic goes. Own the DNS and load-balancer layer of a package registry and you own everyone who trusts it. We saw the same delivery-layer logic at work in the Virtualizor poisoning we covered on 1 September, where attackers rerouted update servers for 33 hours to push malicious code to hosting providers.
Registry infrastructure needs the same identity hardening, phishing-resistant MFA and change alerting as production itself. Assume anything less and someone will walk in the front door of your CDN.
Rotate the keys. Read the flow logs. Trust the registry a little less tomorrow than you did yesterday.
