Coder, the vendor behind the self-hosted cloud development environment platform, has confirmed that an unauthorized actor compromised a Cloudflare API key and used it to reroute a portion of traffic bound for registry.coder.com to attacker-controlled servers. For roughly fourteen hours on Monday, August 31, 2026, from 07:35 to 21:45 UTC, those servers returned tampered Terraform modules carrying credential-stealing code, with harvested secrets exfiltrated to the lookalike domain coder-infra[.]com. Coder published its own incident writeup on September 4 alongside GitHub security advisory GHSA-vx42-ghc9-gw65. The platform is used by Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, and U.S. government and defense organizations, per BleepingComputer's reporting. Coder states its own codebase and Google Cloud infrastructure were not compromised, but also concedes it cannot enumerate every affected deployment, because the rogue servers talked directly to customers without ever passing through Coder's infrastructure.
What Happened
The mechanics are unusually clean, and that is what makes this incident worth studying rather than filing. Nothing in Coder's registry was modified. Coder's build pipeline was not touched. The published modules in Coder's repository remain intact. What changed was the answer to the question of where registry.coder.com actually lived.
An actor holding a valid Cloudflare API key added unauthorized IP addresses to the origin pool serving that hostname. Cloudflare, doing exactly what it was configured to do, load-balanced a subset of incoming registry requests onto infrastructure Coder did not run. Those servers hosted an altered copy of the Coder registry. DNS resolved correctly. TLS handshakes completed against a legitimate certificate for a legitimate hostname. The module that came back was not the one Coder published.
Coder says it identified and fully remediated the issue the same day: malicious IPs removed, cache cleared, registry.coder.com confirmed clean. Patch releases 2.37.0, 2.36.4, 2.35.7 and 2.34.9 close the delivery path and include automatic remediation steps. Kobaran reports that everything prior to 2.37.0 is listed as affected and that Coder rated the incident critical with a CVSS v4 base score of 9.0; that severity figure appears in that account and is not independently confirmed across the other sources reviewed here.
Accounts of the entry vector are not fully aligned. Coder's own statement and Gblock both describe a compromised Cloudflare API key without characterizing how it was obtained. Full Circle Cyber goes further, attributing the breach to "weak API authentication mechanisms" and access-control misconfigurations, mapping it to CWE-77 and CWE-287. That causal claim appears in that outlet alone and is not supported by Coder's disclosure. Treat it as speculation until the vendor says otherwise.
What Was Taken
Coder describes the malicious modules as information stealers that ran on infected hosts during workspace builds. Per Coder's advisory as reported by BleepingComputer, the collection targets included:
- Provisioner environment variables and secrets
- Cloud infrastructure and AI-tooling API keys
- CI/CD credentials
- Configuration-file secrets and terminal history
- User OIDC tokens
- SSH keys and external authentication tokens
Coder's own blog post specifically names AWS, GCP and Azure credentials as exfiltration targets. SecurityOnline adds technical detail on execution: the code ran through a Terraform data "external" "telemetry" block, invoking scripts named dlp.sh and dlp-docker.sh. That account also notes that where the provisioner ran inside coderd itself, the malicious code could potentially reach the Coder database password and other deployment parameters, which is the worst-case blast radius in this incident.
There are two meaningful limits Coder has stated. Refresh tokens were not passed to the provisioner and were therefore not exposed. And Coder found no evidence of impact to customer data it maintains directly. Neither of those constrains what was taken from customer environments.
No source provides a victim count, a record count, or a volume of stolen credentials, and none should be inferred. Coder has been explicit that because the attacker infrastructure sat outside its control, it cannot conclusively identify every compromised deployment. The absence of a number here is a genuine intelligence gap, not an omission.
Why It Matters
Every heuristic the industry has taught developers for defending against malicious packages failed here, and failed silently.
There was no typosquatted module name. There was no unfamiliar source. There was no new maintainer, no suspicious version bump, no unsigned artifact from an unexpected repository. A developer who did everything right, who allowlisted downloads to the single trusted registry hostname their vendor's default templates already pointed at, still received a poisoned module. As SecurityOnline put it, neither a domain check nor restricting downloads to the trusted address offered any protection.
The second uncomfortable point is timing. The exposure window closed on August 31. Coder's public blog landed September 4, with the advisory a few days earlier. That is a reasonable disclosure cadence by industry standards, and it still means any credential harvested in that window had roughly a week of unmonitored usefulness before most defenders knew to look. Patching cannot revoke a secret that has already left the building.
Third, the cached-artifact problem outlives remediation. A deployment that pulled a tampered module during the window may still be carrying it in cache after upgrading to a patched release. Clean registry plus patched binary does not equal clean deployment.
Finally, this is a CDN-layer supply chain attack against the control plane rather than the artifact. The trust anchor that broke was the mapping between a hostname and its origins, held in a third-party configuration console and protected by an API key. Any organization that fronts a package registry, an update channel, or a binary distribution endpoint with a CDN has the same single credential sitting in front of the same trust assumption.
The Attack Technique
Reconstructing from the sources, the sequence looks like this:
Staging. The lookalike domain coder-infra[.]com was registered on August 28, three days before the delivery window, per Kobaran and SecurityOnline. That is deliberate preparation, not opportunism.
Access. An unidentified actor obtained a valid Cloudflare API key for Coder's account. Coder confirms the key compromise; it has not publicly said how the key was obtained, and no source reviewed here establishes that independently.
Redirection. The actor edited the origin pool behind registry.coder.com, adding IP addresses under their control. Cloudflare then distributed a fraction of registry requests to those origins. The partial routing is significant: it kept the operation quiet, and it means exposure is probabilistic rather than universal even among deployments that pulled during the window.
Delivery and execution. The rogue origins served modified Terraform modules. On workspace build or template creation, the embedded external data block executed the stealer scripts, which swept environment variables, config files and terminal history, then shipped results to the lookalike domain.
Duration. Fourteen hours, 07:35 to 21:45 UTC on August 31. All eight sources agree on this window with no variance.
By Coder's account, exposure most commonly occurred when an organization created a new template or template version, or created a workspace with module caching disabled. Caching is on by default, which makes the second path less common. SecurityOnline adds trial builds and deployments during the window to the suspect list. If none of those activities occurred in that fourteen-hour period, Coder says you are very likely not affected.
What Organizations Should Do
If you run Coder, the vendor's own remediation guidance is the authoritative path. In priority order:
-
Hunt for the exfiltration indicator first. Check firewall, proxy, DNS and VPC flow logs for any outbound connection to
coder-infra[.]com. This is the single highest-value IOC and it is retrospective, so pull historical logs covering August 31 rather than only monitoring forward. -
Search provisioner logs for
data.external.telemetry. Its presence indicates the malicious external data block executed in your environment. Identify which modules were downloaded during the 07:35 to 21:45 UTC window. -
Rotate on the assumption of compromise, not on proof of it. Any cloud credential, API token, SSH key, CI/CD secret or OIDC token that was reachable from a system running workspace templates during the window should be treated as burned. Where the provisioner ran inside
coderd, include the Coder database password. Because Coder cannot tell you whether your specific request hit a rogue origin, the absence of a confirmation is not an all-clear. -
Purge caches, then patch. Upgrade to 2.37.0, 2.36.4, 2.35.7 or 2.34.9, which include automatic remediation steps, but run Coder's published SQL queries against your deployment to identify affected cached modules and template versions and remove them. Upgrading alone does not evict a poisoned artifact already sitting in cache.
-
Review access logs for use of the stolen secrets. Rotation stops future abuse; it does not tell you whether the keys were used between August 31 and the day you rotated. Audit cloud provider access logs, CI/CD run histories and Git activity for anomalous authentication in that period.
-
Audit your own CDN control plane. Inventory every API token with edit rights over DNS records, origin pools and load balancer configuration for any distribution endpoint you operate. Scope them down, put them behind hardware-backed MFA, and alert on origin pool changes as a security event rather than a routine config event. This is the class of change that produced a fourteen-hour supply chain compromise at a vendor serving Fortune 500 and government customers, and at most organizations it currently generates no alert at all.
Sources: Hackers Rerouted Coder's Registry Traffic for 14 Hours to Plant Cre... | Coder's registry infrastructure compromised to push malicious ... | Coder's Registry Hijacked to Deliver Credential-Stealing Terraform... | Coder Registry Attack Served Malicious Terraform | Security Breach: Coder’s Registry Hacked to Distribute Malicious Mo... | Coder Registry Hijack Stole Dev API Keys for 14 Hours - Gblock | Coder Platform Cloudflare Hack Delivers Malicious Terraform Modules... | Coder Registry Security Incident: What Happened and What to Do