Coder Infrastructure Breach: Attackers Served Malicious Terraform Modules

Coder, the company behind a platform for self-hosted cloud development environments, has disclosed a compromise of the infrastructure powering its package registry. Developers pull the components for workspace templates through registry.coder.com — and it was precisely this delivery channel that fell under the attackers' control.

How the attack worked

Coder's registry runs behind Cloudflare, but an unknown attacker gained access to the underlying infrastructure and added unauthorized IP addresses to the pool. As a result, Cloudflare began routing a portion of requests to the attacker's servers, which served a spoofed version of the registry with malicious artifacts.

According to the company, the window during which infected files were delivered fell on Monday, August 31, from 07:35 to 21:45 UTC. During that period, some users received modified Terraform modules — ready-made sets of instructions for deploying and configuring infrastructure.

What the malware stole

The spoofed modules acted as an infostealer: they searched for environment variables and provisioner secrets, cloud service and AI tool API keys, CI/CD credentials, secrets from configuration files, terminal history, users' OIDC tokens, configured SSH keys, one-time external authentication tokens, and — when run inside coderd — Coder's database passwords as well. The harvested data was sent to the lookalike domain coder-infra[.]com.

The platform is used by major private and government organizations — among them Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, as well as the U.S. government and defense contractors, which makes the incident especially sensitive.

Recommendations

Coder urges all potentially affected users to rotate all of the listed secrets as soon as possible. Before upgrading to the patched versions (2.37.0, 2.36.4, 2.35.7, and 2.34.9), it is recommended to review firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com. Developers are also advised to search provisioner logs for data.external.telemetry entries, identify modules downloaded during the dangerous window, and remove suspicious cached packages. To check for exposure, the company has published a SQL query that flags potentially compromised cached modules and template versions.

Coder notes that refresh tokens were not passed to the provisioner and that no signs of access to customer data were found. However, because the attacker's infrastructure is beyond the company's control, it does not have access to key logs — which means it is impossible to reliably determine every compromised deployment.

Source: Bleeping Computer