Coder Registry Compromise Distributed Credential-Stealing Terraform Modules
Summary
Attackers compromised Coder’s Cloudflare infrastructure, redirecting some registry traffic to servers that delivered malicious Terraform modules and stole secrets. Coder recommends rotating affected credentials and checking logs.
Key points
- Attackers added unauthorized servers to Coder’s Cloudflare-backed registry pool, causing some requests to receive malicious modules.
- The exposure window ran from 07:35 UTC to 21:45 UTC on Monday, August 31.
- The modules searched for secrets including cloud and AI API keys, CI/CD credentials, OIDC tokens, SSH keys, and configuration secrets.
- Stolen information was sent to coder-infra[.]com.
- Coder advised potentially affected users to rotate impacted secrets, inspect relevant network and provisioner logs, and purge potentially malicious cached packages.
- Coder said refresh tokens were not passed to the provisioner and it had no evidence of impact to customer data it maintained.
- Coder said it lacks access to crucial logs from the attacker’s infrastructure and cannot conclusively identify every compromised deployment.
Article Details
- Victim Organization
- Coder
- Victim Domain
- registry.coder.com
- Incident Type
- Compromise of Coder's Cloudflare infrastructure to redirect registry traffic and distribute malicious Terraform modules containing credential-stealing code.
- Data Types Exposed
- Provisioner environment variables and secrets
- Cloud infrastructure and AI-tooling API keys
- CI/CD credentials
- Configuration-file secrets
- Terminal history
- User OIDC tokens
- Configured SSH keys
- One-time external authentication tokens
- Coder database passwords and other configuration secrets
- Operational Impact
- Unauthorized servers were added to Coder's registry pool, and some registry requests during the stated delivery window were routed to those servers, which delivered modified Terraform modules to a subset of users. Coder could not conclusively identify every compromised deployment because it lacked access to logs from the attacker's infrastructure. Coder reported no evidence of impact to customer data it maintained.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | coder-infra[.]com | Lookalike domain identified by Coder as the destination to which the malicious modules exfiltrated collected information. |