Coder Registry Infrastructure Compromise – Malicious Terraform Modules

Technical Analysis

The attackers compromised Coder's Cloudflare infrastructure, likely via stolen API tokens, DNS/zone misconfiguration, or account takeover, and stood up unauthorized registry endpoints mimicking legitimate Terraform module sources. Victims running 'terraform init' or automated IaC pipelines against these registries unknowingly pulled malicious modules embedding code designed to exfiltrate environment variables, cloud provider credentials, and secrets during provisioning. This is a classic dependency-confusion/registry-poisoning supply-chain attack pattern, similar to prior npm/PyPI registry compromises, but targeting infrastructure-as-code tooling rather than application dependencies. Because Coder is widely used to provision development and cloud workspaces—including environments that host AI agent frameworks, LLM tool-calling infrastructure, and RAG pipeline backends—any credentials harvested (cloud API keys, vector DB tokens, LLM provider keys) could be leveraged to pivot into agent-connected systems, exfiltrate model API keys, or hijack agent-provisioned compute resources.

Affected Systems

Coder Terraform module registry infrastructure hosted on Cloudflare; CI/CD and IaC pipelines that reference Coder-hosted or Coder-published Terraform modules; developer/cloud workspace provisioning systems using affected modules between the compromise window and remediation

Indicators of Compromise

• Unauthorized/rogue Terraform registry endpoints (domains not matching official registry.coder.com or verified Coder infrastructure)
• Modified Terraform module source URLs pointing to attacker-controlled Cloudflare Workers/Pages
• Outbound network connections to unexpected exfiltration domains during 'terraform init'/'terraform apply'
• Unexpected environment variable or credential file read operations within Terraform provider execution logs

Remediation Steps

1. 1

   Audit Terraform module sources

   Review all Terraform configurations for references to Coder-hosted registries and verify module source URLs against known-good, officially published locations.

2. 2

   Rotate exposed credentials

   Immediately rotate all cloud provider credentials, API keys, and secrets that may have been accessible in environments where affected modules were applied, including any LLM/AI service API keys used by agents provisioned through these pipelines.

3. 3

   Pin and verify module checksums

   Use Terraform provider/module checksum locking (.terraform.lock.hcl) and verify hashes against trusted sources to prevent silent substitution of malicious modules.

4. 4

   Review provisioning logs

   Inspect terraform init/apply logs and network egress logs for connections to unauthorized registry endpoints during the compromise window.

5. 5

   Monitor for downstream credential abuse

   Enable alerting on cloud provider and API key usage for anomalous access patterns, especially for keys tied to agent orchestration, vector databases, or LLM providers.