GoKawiilCoder's Cloudflare-hosted registry hijacked to serve credential-stealing Terraform modules
Attackers breached Coder's Cloudflare infrastructure and inserted rogue servers into registry.coder.com's IP pool, causing some requests to be routed to malicious infrastructure instead of Coder's own. For roughly 14 hours on August 31, these servers distributed tampered Terraform modules containing code designed to harvest secrets from developer machines.
GoKawiil's interpretation of the reporting above, not reported fact.
Coder's platform underpins cloud development environments at major firms like Dropbox, Palantir, Square, and even U.S. government and defense agencies, meaning stolen credentials could enable deep follow-on compromises across sensitive infrastructure. The incident also illustrates how attackers can exploit CDN-level trust—compromising Cloudflare routing rather than the application itself—to silently poison software supply chains.
- Attackers manipulated Cloudflare infrastructure to redirect registry traffic to malicious servers.
- Tainted Terraform modules were live for about 14 hours on August 31, targeting API keys, SSH keys, and CI/CD credentials.
- Coder's enterprise and government clientele raises the stakes of any credentials exposed during the breach.
Yubico YubiKey 5 NFC Security Key — Supply-chain attacks like the Coder registry compromise often start with stolen credentials, and the YubiKey 5 NFC adds a hardware-backed second factor that phishing pages can't replay. It works over USB-A and NFC with major identity providers and developer platforms like GitHub, so protecting your accounts takes a tap. A smart, pocket-sized upgrade for anyone shipping code.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-03
Published there as: “Coder's registry infrastructure compromised to push malicious modules”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.