Coder Registry Compromise Pushes Malicious Modules

A Coder registry compromise allowed attackers to distribute malicious Terraform modules containing credential-stealing code to a subset of users.

The attackers accessed Coder’s Cloudflare infrastructure and added unauthorised servers to the pool behind the company’s module registry. Coder has released patched versions and advised potentially affected users to rotate exposed secrets.

Rogue servers delivered malicious modules

Coder said the attack targeted registry.coder.com, its package-hosting service for workspace template components.

Although the service operated behind Cloudflare, the attackers gained access to the underlying infrastructure. They then added unauthorised IP addresses to the registry server pool.

Cloudflare subsequently directed some requests to the attacker-controlled servers instead of legitimate Coder infrastructure. Those systems supplied modified Terraform modules containing malicious code.

The delivery window ran from 07:35 UTC to 21:45 UTC on August 31.

Credential stealer targeted development secrets

The malicious Terraform modules operated as information stealers on affected hosts. They searched for provisioner environment variables, cloud credentials and API keys used by AI tools.

The malware also targeted CI/CD credentials, configuration-file secrets, terminal history, OIDC tokens, SSH keys and one-time authentication tokens.

In cases where the provisioner ran within coderd, the malicious code could also seek Coder database passwords and other configuration secrets. The attackers exfiltrated collected data to a lookalike domain, coder-infra[.]com.

Coder said refresh tokens were not passed to the provisioner. It also found no evidence that customer data maintained by the company was affected.

Coder urges users to patch and rotate secrets

Coder recommends that organisations first review firewall, proxy, DNS and VPC flow logs for connections to coder-infra[.]com. Teams should also examine provisioner logs for data.external.telemetry.

Users should identify modules downloaded during the exposure window and remove potentially malicious cached packages. They should then rotate all potentially exposed credentials and secrets.

Coder has released patched versions 2.37.0, 2.36.4, 2.35.7 and 2.34.9. The company also provided an SQL query to help users identify affected cached modules and template versions.

However, Coder warned that it cannot conclusively identify every affected deployment because the attacker-controlled infrastructure sits outside its control.