Coder’s Cloudflare Registry Breached, Malicious Terraform Modules Distributed

Coder, a platform that provides cloud‑based development environments, confirmed that its registry infrastructure was compromised after attackers gained access to its Cloudflare configuration and introduced unauthorized registry servers. The rogue servers served Terraform modules embedded with code designed to harvest credentials from users who downloaded them.

The breach centers on Coder’s use of Cloudflare as a content delivery and DNS service for its module registry, which developers rely on to obtain reusable infrastructure‑as‑code components. By inserting counterfeit registry endpoints into the DNS records, the intruders were able to present seemingly legitimate modules to unsuspecting users.

Analysis of the malicious packages revealed that they contained scripts that, once executed during a Terraform run, attempted to locate and exfiltrate cloud access keys, API tokens, and other sensitive authentication material. Terraform, a widely adopted tool for provisioning infrastructure, often runs with elevated privileges, making any embedded credential‑stealing logic particularly dangerous.

The incident was first highlighted by security reporting outlet BleepingComputer, which cited technical details shared by independent researchers who observed the unexpected registry URLs and the payload behavior. According to the reports, the malicious modules were available for a brief window before Coder detected the irregularities and began remediation.

While the exact number of affected downloads remains unclear, the potential impact extends to any organization that sourced Terraform modules from Coder’s registry during the intrusion period. Security experts advise users to audit recent Terraform runs, rotate any credentials that may have been exposed, and verify the integrity of modules against known trusted sources.

Coder issued a statement acknowledging the compromise and outlined steps taken to secure its infrastructure, including restoring original DNS records, removing the unauthorized servers, and enhancing monitoring of registry traffic. The company also urged customers to review their Terraform configurations and to adopt best practices such as pinning module versions and employing checksum verification to guard against similar supply‑chain attacks in the future.