Coder’s registry infrastructure was compromised by an unidentified attacker who used unauthorised servers to distribute malicious Terraform modules containing credential-stealing code.
The incident affected registry.coder.com, the package-hosting service used by developers to obtain components for workspace templates. Coder said some requests were routed by Cloudflare to the attacker’s servers rather than its legitimate infrastructure.
The unauthorised modules were available between 07:35 UTC and 21:45 UTC on Monday, August 31. They were modified versions of Terraform modules, which are used to create and configure cloud and other computing infrastructure.
Coder said the malicious code operated as an information stealer when the modules were run. It searched provisioner environment variables and secrets, cloud infrastructure and artificial intelligence tooling keys, CI/CD credentials, configuration files and terminal history.
The code could also collect user OpenID Connect tokens, SSH keys, one-time external authentication tokens, and Coder database passwords and other configuration secrets where the provisioner was running inside coderd.
The stolen information was sent to the lookalike domain coder-infra[.]com, according to the company.
Coder advises users to investigate possible exposure
Coder has advised potentially affected users to rotate all credentials and secrets that may have been exposed. Before moving to a patched release, users should check firewall, proxy, DNS and virtual private cloud flow logs for connections to the domain.
They should also review provisioner logs for references to data.external.telemetry, establish which modules were downloaded during the exposure window and remove potentially malicious packages from local caches.
Patched Coder versions are 2.37.0, 2.36.4, 2.35.7 and 2.34.9. The company has also provided an SQL query to help identify affected cached modules and template versions.
Coder said refresh tokens were not passed to the provisioner and that it had found no evidence that customer data held by the company was affected.
However, it said the attacker’s servers were outside its control, meaning it did not have access to all the relevant logs and could not conclusively determine whether every potentially exposed deployment had been compromised.
Coder provides self-hosted cloud development environments for organisations building and deploying software, including artificial intelligence applications. Its users include companies such as Dropbox, Palantir, Square, Mercedes-Benz, KKR and EnBW, as well as US government and defence organisations.
