The Coder registry compromise was a supply chain attack in which an attacker gained access to Coder's Cloudflare infrastructure, added unauthorized servers to the registry.coder.com pool, and used them to deliver malicious Terraform modules that stole secrets from a subset of users. Coder is a platform for self-hosted cloud development environments, used by organizations including Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government, and defense companies, which makes its package registry a high-value target. Because Cloudflare routed some requests to the rogue servers, affected users received tampered modules without any obvious warning.

The malicious delivery window ran from 07:35 to 21:45 UTC on Monday, August 31, 2026. During that time the rogue servers served modified Terraform modules, ready-made infrastructure bundles, that behaved as information stealers on the hosts that ran them. According to Coder, the modules searched for provisioner environment variables and secrets, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets, terminal history, user OIDC tokens, configured SSH keys, one-time external authentication tokens, and Coder database passwords when the provisioner ran inside coderd. The stolen data was exfiltrated to the lookalike domain coder-infra[.]com.

Coder has released fixed versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, and urges any potentially impacted users to rotate every secret in that list immediately. Before upgrading, the project recommends reviewing firewall, proxy, DNS, and access logs for connections to the malicious domain during the delivery window to gauge exposure.

Why is a package registry such a dangerous single point of failure?

Because a registry is trusted by default and its output runs with real privileges. Developers pull modules automatically as part of provisioning, so a compromised registry injects attacker code straight into the build and infrastructure path without anyone reviewing it. Here the attacker never needed to breach each victim directly; poisoning one trusted distribution channel, and abusing the CDN routing in front of it, delivered stealer code to many downstream users at once. That is the defining leverage of a software supply chain attack.

What should Coder users do right now?

Treat any secret that a provisioner could touch as burned. Rotate cloud and AI API keys, CI/CD credentials, SSH keys, OIDC tokens, and Coder database passwords, then upgrade to a patched release. Hunt historical logs for traffic to coder-infra[.]com between 07:35 and 21:45 UTC on August 31, because the absence of an on-disk artifact means network telemetry is often the clearest evidence of exposure.

Our read

This incident lands squarely in the fastest-growing risk category we track: code and infrastructure you never wrote, pulled automatically from a channel you were told to trust. The attacker did not need a zero-day in Coder itself; they needed control of the routing in front of the registry, and the modules did the rest. The defensible move is to assume any dependency or module can be hostile, pin and verify what you pull, keep provisioner secrets short-lived and least-privileged, and continuously check what your build actually executes rather than trusting the source by name. Verifiable by design beats trusted by reputation.

Reporting by BleepingComputer; incident detail per Coder's security advisory. Sources linked above.

Related: What is a software supply chain attack? and What is infrastructure as code security?.