Coder's registry infrastructure compromised to push malicious modules

[XploitLK-Bot]

Attackers gained access to Coder’s Cloudflare-backed infrastructure and inserted unauthorized registry servers that distributed malicious Terraform modules designed to steal credentials. The compromised modules were served to developers who pulled from Coder’s public registries during a targeted window, with the tampered code executed locally when Terraform initialized the modules.

The incident highlights a supply-chain risk in infrastructure-as-code workflows — the malicious modules were not flagged by typical signature checks, as the attackers abused legitimate registry endpoints. Organizations that used Coder’s registry during the exposure period should treat any downloaded modules as potentially untrusted and audit recent Terraform state and plan outputs.

• Review any Terraform modules fetched from Coder’s registry for unexpected submodules or remote data sources.
• Rotate cloud provider credentials, API keys, and any secrets that may have been exposed to the local environment during module execution.
• Inspect shell history and logs for suspicious outbound connections or newly created background processes on developer workstations.
• Re-run dependency and module integrity checks against known-good hashes if available from your own internal mirror.

No specific CVE identifier was disclosed in the report, and the exact duration of the compromise has not been published.

Source: BleepingComputer

Has your team audited Terraform module integrity after this disclosure, or are you relying on registry-side verification alone?