Hackers Hijack Coder Registry to Push Malicious Terraform Modules and Steal Cloud Credentials

A critical security incident at Coder exposed users of its Terraform module registry to malicious packages designed to steal credentials from cloud development environments.

The attack involved unauthorized changes to Coder’s Cloudflare infrastructure, allowing an unidentified threat actor to redirect some registry traffic to attacker-controlled servers.

According to Coder’s security advisory, the attacker added unauthorized IP addresses to the infrastructure pool used by the Coder module registry. Those servers hosted a rogue registry containing modified Terraform artifacts with credential-stealing code.

The affected service was Coder’s main registry, registry.coder.com, which is commonly used as a source of workspace templates and modules. The malicious packages were available between 07:35 UTC and 21:45 UTC on August 31, 2026.

Organizations may have been exposed if they created a new Coder workspace template, updated an existing template version, ran a template dry run, or deployed a workspace. At the same time, Terraform module caching was disabled.

Hackers Hijack Coder Registry

The injected code targeted secrets available to the Terraform provisioner environment. Coder said the malware attempted to identify credentials and exfiltrate them to a remote server using a lookalike domain, coder-infra[.]com.

The domain was designed to resemble legitimate Coder infrastructure, making malicious outbound connections harder to identify during routine log reviews. The malicious Terraform modules reportedly used a data.external.telemetry block to execute a script named dlp-docker.sh.

That script communicated with the attacker-controlled endpoint at www[.]coder-infra[.]com/cli/check and sent data through an X-CLI-Token HTTP header. The advisory identified 199.91.220[.]205 as an associated IP address.

The impact depends on how the malicious module was executed. During template imports, updates, and dry runs, the primary risk was exposure of environment variables and secrets available on the provisioner host.

In a workspace build, the malicious code could also access temporary user secrets passed to the provisioner. These may include a user OIDC token, an SSH key where configured, and one-time external authentication tokens.

Organizations running the provisioner within the main Coder service may face a broader exposure. In that deployment model, the malware may have accessed Coder configuration values, including database credentials, external authentication provider settings, and other application secrets.

Coder stated in its GitHub advisory GHSA-vx42-ghc9-gw65 that there was no indication that customer data maintained by the company was affected.

Coder released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. Users running versions earlier than 2.37.0 should remove potentially malicious registry modules from their cache and update.

Security teams should review Coder deployment records for module downloads within the affected window and search DNS, firewall, proxy, and VPC flow logs for connections to coder-infra[.]com.

They should also inspect provisioner logs for the string data.external.telemetry, which can indicate execution of the malicious Terraform block. Affected organizations should remove cached modules retrieved during the exposure period before redeploying templates.

They should then rotate all credentials that could have been accessible to the Coder deployment, particularly cloud API keys, CI/CD secrets, AI tooling tokens, SSH keys, OIDC tokens, and credentials stored in environment variables or terminal history.

The incident highlights a supply-chain risk in infrastructure-as-code workflows. Even trusted Terraform registries can become a route for credential theft when attackers compromise traffic-routing or package-distribution infrastructure.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.