Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. The supply chain attack targeted infrastructure-as-code pipelines, potentially exposing credentials and enabling unauthorized access for users of Coder Registry.

What should defenders do?

Coder should revoke compromised credentials, audit registry configurations, rotate all secrets associated with the registry, and release patched versions of affected modules. Terraform users should verify module integrity against official checksums, avoid pulling from unverified registries, and audit existing pipelines for signs of compromise. Cloudflare-assisted remediation is likely in progress.

highMalware

Coder's Registry Infrastructure Compromised to Distribute Malicious Terraform Modules

Unauthorized registry servers delivered credential-stealing code to Terraform users via compromised Cloudflare infrastructure

CyberIntel DeskPublished 25 days agoUpdated less than a minute ago1 min read

Coder's Registry Infrastructure Compromised to Distribute Malicious Terraform Modules

Key Takeaways

Attackers compromised Coder's Cloudflare infrastructure to insert unauthorized registry servers.
Malicious Terraform modules containing credential-stealing code were distributed to users.
The attack targets infrastructure-as-code supply chains, risking credential theft and unauthorized access.
Coder and Cloudflare are engaged in remediation, including credential revocation and configuration audits.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read