Attackers hijacked Coder's registry through its Cloudflare infrastructure to serve credential-stealing modules

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code, BleepingComputer reported. Coder disclosed earlier this week that an attacker targeted registry.coder.com, the package-hosting site developers use to source components for workspace templates. Although the registry runs behind Cloudflare, the attacker gained access to the underlying infrastructure and added unauthorized IP addresses to the pool used for the module registry. As a result, Cloudflare routed some registry requests to the attacker's servers instead of Coder's legitimate ones, delivering malicious files to a subset of users. "An unidentified malicious actor gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool used for Coder's module registry," Coder's advisory said. The Coder platform lets organizations provide developers with self-hosted cloud development environments for building and deploying software, including AI applications. Its users include Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government and defense companies, according to the report. The incident is a supply-chain compromise aimed at developer tooling rather than end users, and it shows that a content delivery layer does not protect a registry if the origin pool behind it can be altered. Organizations that pulled Terraform modules from the registry during the affected period should review what was fetched and rotate any credentials that may have been exposed.