Full Report
The attacker gained unauthorized access to Coder’s Cloudflare infrastructure and added attacker-controlled IP addresses to the pool serving Coder’s module registry. These servers hosted modified registry artifacts containing malicious code designed to discover credentials and ...
Analysis Summary
# Incident Report: Coder Module Registry Supply Chain Compromise
## Executive Summary
An unauthorized actor compromised Coder’s Cloudflare infrastructure to inject malicious IP addresses into the pool serving the Coder module registry. This allowed the distribution of modified registry artifacts containing credential-stealing malware to users during template creation or updates. Coder responded by rotating infrastructure credentials and releasing a software update to force-clear malicious cached templates.
## Incident Details
- **Discovery Date:** Late August 2026 (Reported September 1, 2026)
- **Incident Date:** August 2026
- **Affected Organization:** Coder
- **Sector:** Software Development / Infrastructure-as-Code (IaC)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026
- **Vector:** Unauthorized access to Cloudflare infrastructure.
- **Details:** The attacker gained entry to Coder’s Cloudflare account and modified the IP address pool for the module registry.
### Lateral Movement
- **Details:** The attacker utilized the compromised infrastructure to proxy requests to attacker-controlled servers hosting malicious versions of Coder modules.
### Data Exfiltration/Impact
- **Details:** Users downloading or updating templates received malicious `dlp.sh` and `dlp-docker.sh` scripts. These scripts were designed to harvest environment variables, cloud API keys, and configuration files, sending them to the lookalike domain `coder-infra[.]com`.
### Detection & Response
- **Detection:** Identified through security monitoring and review of Cloudflare infrastructure changes.
- **Response:** Infrastructure credentials were reset, malicious IPs were removed from the pool, and a security advisory (GHSA-vx42-ghc9-gw65) was issued alongside a mandatory software update.
## Attack Methodology
- **Initial Access:** Compromise of Cloudflare administrative credentials or API tokens.
- **Persistence:** Addition of attacker-controlled IP addresses to the registry service pool.
- **Privilege Escalation:** Not explicitly detailed, but involved administrative rights over Cloudflare Load Balancing/DNS.
- **Defense Evasion:** Use of a lookalike domain (`coder-infra[.]com`) to blend in with legitimate traffic.
- **Credential Access:** Targeted environment variables, terminal history, CI/CD credentials, and AI tooling keys.
- **Discovery:** Reconnaissance of the victim's local environment via automated scripts.
- **Lateral Movement:** Supply chain injection (infrastructure-level).
- **Collection:** Gathering of sensitive configuration files and API secrets.
- **Exfiltration:** HTTPS POST requests to a rogue command-and-control (C2) domain.
- **Impact:** Compromise of customer development environments and potential downstream cloud access.
## Impact Assessment
- **Financial:** Unknown; potential costs related to incident response and legal notification.
- **Data Breach:** Compromise of developer credentials, API keys, and secrets for an unknown number of users.
- **Operational:** Disruption to template registry services; requirement for customers to update and clear caches.
- **Reputational:** Significant impact due to a supply chain breach involving core product infrastructure.
## Indicators of Compromise
- **Network Indicators:**
- `coder-infra[.]com` (C2/Exfiltration Domain)
- **File Indicators:**
- `dlp.sh`
- `dlp-docker.sh`
- **Behavioral Indicators:**
- Terraform `data "external" "telemetry"` blocks within Coder modules.
- Unexpected outbound traffic from development environments to non-standard infrastructure.
## Response Actions
- **Containment:** Removed attacker-controlled IPs from the Cloudflare pool.
- **Eradication:** Rotated all Cloudflare and internal infrastructure credentials.
- **Recovery:** Released a new version of Coder that forces a template cache clear to ensure malicious artifacts are purged from user environments.
## Lessons Learned
- **Infrastructure Security:** Administrative access to critical edge services (Cloudflare) acts as a high-leverage point for supply chain attacks.
- **Caching Risks:** Module caching can prolong the lifespan of an attack even after the source infrastructure is secured.
- **Monitoring:** The need for granular auditing of changes to Load Balancer IP pools and DNS configurations.
## Recommendations
- **MFA:** Enforce hardware-based Multi-Factor Authentication (MFA) for all infrastructure provider accounts (Cloudflare, AWS, etc.).
- **Integrity Checking:** Implement subresource integrity (SRI) or cryptographic signing for modules distributed via the registry.
- **Least Privilege:** Use scoped API tokens for infrastructure management rather than global administrative accounts.
- **Egress Filtering:** Encourage users to implement egress filtering in development environments to block traffic to unknown domains.