Critical Supply-Chain Attack on Coder’s Terraform Registry Exposes Cloud Credentials On August 31, 2026, Coder a provider of cloud development environments disclosed a security breach in its Terraform module registry, where attackers hijacked infrastructure to distribute malicious packages designed to steal credentials. The incident stemmed from unauthorized modifications to Coder’s Cloudflare configuration, allowing threat actors to redirect traffic from registry.coder.com to attacker-controlled servers between 07:35 UTC and 21:45 UTC. The rogue registry hosted tampered Terraform modules containing credential-stealing malware. The attack targeted organizations using Coder workspace templates, particularly those performing template imports, updates, dry runs, or workspace deployments with Terraform module caching disabled. The malicious code, embedded in a data.external.telemetry block, executed a script (dlp-docker.sh) that exfiltrated secrets including environment variables, OIDC tokens, SSH keys, and temporary authentication credentials to a lookalike domain, coder-infra[.]com (resolving to 199.91.220[.]205). The impact varied by deployment model. In standard provisioner environments, the malware accessed local secrets, while deployments running the provisioner within Coder’s main service risked exposure of database credentials, external authentication provider settings, and other application secrets. Coder confirmed no evidence of direct compromise to its customer data storage. To mitigate the threat, Coder released patched versions (2.37.0, 2.36.4, 2.35.7, 2.34.9) and advised users to: - Remove cached modules downloaded during the attack window. - Update to the latest secure versions. - Audit logs for connections to coder-infra[.]com or the data.external.telemetry string. - Rotate all potentially exposed credentials, including cloud API keys, CI/CD secrets, and SSH keys. The incident underscores the growing risk of supply-chain attacks in infrastructure-as-code workflows, where compromised registries can serve as vectors for credential theft. Security teams are urged to scrutinize trusted sources for similar threats.