Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)

Key facts

Detection coverage

As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2373 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Coder Credential-Stealing Script Execution — dlp.sh / dlp-docker.sh Post-Exploitation

Detects execution of the credential-stealing shell scripts dlp.sh or dlp-docker.sh on Coder provisioner hosts. These scripts were invoked via Terraform data external telemetry block and scanned for cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials, OIDC tokens, SSH keys, environment variables, config files, and shell history.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1552.001, T1552.003, T1552.004, T1005
• Data sources: linux_auditd, sysmon_linux, microsoft_defender_for_endpoint_linux
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_audit sourcetype=auditd ("dlp.sh" OR "dlp-docker.sh" OR "dlp")
| eval threat_id="TL-2026-2373"
| eval detection_context="Coder supply-chain compromise: credential-stealing script execution detected"
| table _time, host, user, process, auid, comm, exe, args, threat_id, detection_context
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(30d)
| where SourceSystem == "Linux"
| where ActionType == "ProcessCreated"
| where FileName in~ ("sh", "bash", "dash")
| where ProcessCommandLine has_any ("dlp.sh", "dlp-docker.sh", "dlp")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend threat_id = "TL-2026-2373"
| extend detection_context = "Coder supply-chain compromise: credential-stealing script dlp.sh/dl-docker.sh execution"
| extend ioc_hash = case(
    ProcessCommandLine contains "dlp-docker.sh", "7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398",
    ProcessCommandLine contains "dlp.sh", "a7f4fa5f7e33b2a6f6488cf28444584caa449144d246b083de919162f5514247",
    "unknown"
)
| sort by Timestamp desc

Sigma

title: Coder Credential-Stealing Script Execution (dlp.sh / dlp-docker.sh)
id: d2f6a4b7-9e5c-4d8f-8a1b-3c7e2f6a9b4d
status: experimental
description: Detects execution of the credential-stealing shell scripts dlp.sh or dlp-docker.sh, which were deployed via tampered Terraform modules during the Coder registry supply-chain compromise. These scripts scanned for and exfiltrated cloud, AI, CI/CD, and infrastructure credentials.
references:
    - https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65
    - https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack
author: Threadlinqs Team
date: 2026-09-07
tags:
    - attack.execution
    - attack.t1059.004
    - attack.credential-access
    - attack.t1552.001
    - attack.t1552.003
    - attack.t1552.004
    - attack.t1005
    - attack.collection
    - coder.registry
    - attack.tool.dlp
logsource:
    product: linux
    service: process_creation
    definition: Requires process creation telemetry (Sysmon for Linux, auditd, MDE for Linux)
detection:
    selection:
        - CommandLine|contains: "dlp.sh"
        - CommandLine|contains: "dlp-docker.sh"
        - Image|endswith: "dlp.sh"
        - Image|endswith: "dlp-docker.sh"
    condition: selection
falsepositives:
    - File names or processes coincidentally using the 'dlp' prefix (e.g., data loss prevention tools)
    - Security testing teams simulating the attack
level: critical

Known false positives:

• Legitimate data-loss-prevention scripts that coincidentally use 'dlp' in their filename
• Security research or penetration testing simulations

Tuning notes: Exclude known security testing scripts. The SHA-256 hashes can be used for file hash blocking. The five SHA-256 variants are: a7f4fa5f (common), 414d01f6 (aider), a64ce303 (rstudio-server), ebbe0d2e (windows-rdp), 7ef6b8c3 (zed). These scripts execute in the Coder provisioner context and may be short-lived — enable real-time process auditing.

• 🔒 Coder Provisioner Process Execution — Terraform External Data Block — Supply Chain · unlock with TL Creds
• 🔒 Coder Credential Access via File and Config Scanning — Post-Exploitation · unlock with TL Creds
• 🔒 Coder Exfiltration via [indicator] HTTP Header — C2 Channel Detection · unlock with TL Creds
• 🔒 Rogue Origin IP Access to Coder Registry — Cloudflare Pool Hijack · unlock with TL Creds
• 🔒 Coder Credential-Stealing Script via Terraform Provisioner — Script File Access Pattern · unlock with TL Creds
• 🔒 Coder Automated Exfiltration — Rapid Sequential Outbound Connections to Exfiltration Domain · unlock with TL Creds
• 🔒 Coder Terraform Data External Telemetry Block Execution — Supply Chain Exploitation · unlock with TL Creds
• 🔒 Coder Exfiltration to Lookalike Domain [indicator] — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-10-28, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2373.

Sample indicators (3 of 18)

• IP address: 199.91.220[.]205
• Domain: coder-infra[.]com
• URL: hxxps://registry[.]coder[.]com

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

Technical analysis

The attack was rated CVSS 9.0 (Critical) under CVSS v4; no CVE was assigned. Coder released patched versions 2.37.0/2.36.4/2.35.7/2.34.9 on September 1, 2026.

On August 31, 2026, between 07:35 and 21:45 UTC, an unidentified threat actor compromised a Cloudflare API key belonging to Coder, the remote-development platform. Using this compromised key, the attacker added rogue IP addresses—including 199.91.220.205—to the Cloudflare origin pool behind Coder's module registry hostname, registry.coder.com. This caused Cloudflare's load balancer to route a subset of legitimate registry requests to attacker-controlled servers hosting a tampered copy of the Coder Terraform module registry.

Users who created or updated templates, ran template dry-runs, or built workspaces (with module caching disabled) during the exposure window received poisoned Terraform modules. These modules contained a Terraform data "external" "telemetry" block that invoked bundled shell scripts—dlp.sh (five variants targeting common, aider, rstudio-server, windows-rdp, and zed environments) and dlp-docker.sh—at provision time. The scripts scanned the host for credentials and secrets, including cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials and Git tokens, environment variables, configuration files, and shell history (bash_history). For workspace builds, the provisioner also exposed the user's OIDC token, SSH key, and single-use external-auth tokens (GitHub, GitLab, Bitbucket). Where the provisioner ran inside coderd rather than as a separate service, the database password and deployment configuration variables were also exposed.

Exfiltrated data was sent via HTTP to the lookalike domain coder-infra.com (registered three days prior, on August 28, 2026, via registrar Trustname.com / Fewmoretaps OU, using Cloudflare nameservers leah.ns.cloudflare.com and matias.ns.cloudflare.com), specifically to the endpoint http://www.coder-infra.com/cli/check, authenticated with the header X-CLI-Token.

Coder disclosed the incident on September 1, 2026 via GitHub Security Advisory GHSA-vx42-ghc9-gw65 (CVSS 9.0 Critical under CVSS v4.0) and released patched builds for versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. No CVE was assigned, as the compromise targeted delivery infrastructure rather than a code flaw. No evidence of compromise to Coder's own codebase, Google Cloud infrastructure, or customer data maintained by Coder was found. However, Coder stated it cannot conclusively identify every affected deployment because the attacker's infrastructure was outside Coder's control.

Coder's notable customers include the U.S. Department of Defense, Palantir, Dropbox, Discord, Square, Mercedes-Benz, and KKR (which led a $90M Series C in April 2026). The incident highlights a fundamental supply-chain gap: domain allowlisting and version pinning were ineffective because the legitimate domain itself served the malicious artifacts. Standard defenses—SBOM/AIBOM inventories, package cooldown windows, and checksum verification—did not trigger because no new packages were published and no code flaws were involved, only infrastructure manipulation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.003 Shell History; T1552.004 Unsecured Credentials: Private Keys

defense-impairment

T1553 Subvert Trust Controls

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1584.001 Compromise Infrastructure: Domains; T1587.001 Develop Capabilities: Malware

Remediation

Patches

• Upgrade Coder to v2.37.0, v2.36.4, v2.35.7, or v2.34.9

Immediate actions

• Review firewall, proxy, DNS, and VPC flow logs for outbound traffic to coder-infra.com or 199.91.220.205
• Search provisioner job logs for the sentinel string 'data.external.telemetry'
• Run Coder's SQL cache-purge query: remove cached modules fetched during the exposure window (created_by = '00000000-0000-0000-0000-000000000000', mimetype = 'application/x-tar', creation between 2026-08-31 07:35 and 2026-08-31 21:45 UTC)
• Upgrade Coder to patched versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9
• Rotate all credentials accessible from affected provisioners: cloud API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD tokens, Git tokens, container registry credentials, Coder API session tokens, SSH keys, OIDC tokens, kubeconfigs

Workarounds

• Enable Terraform module caching (default behavior provides partial protection as cached safe copies are not re-fetched)
• Disable or restrict access to the module registry during incident investigation

Longer-term hardening

• Pin and cache Terraform modules through an internal mirror to decouple from upstream registry availability
• Scope provisioner credentials per template with short-lived tokens and least-privilege IAM roles
• Implement egress controls and behavioral monitoring: hostname allowlisting is insufficient when the payload arrives from the correct hostname
• Treat registry, CDN, and DNS infrastructure as critical trust boundaries in supply-chain risk assessments
• Add checksum verification for registry modules in .terraform.lock.hcl

Affected and fixed versions

• Coder — Coder (remote development platform)
  Vulnerable versions: <2.37.0; 2.34.x before 2.34.9; 2.35.x before 2.35.7; 2.36.x before 2.36.4
  Fixed in: 2.37.0; 2.36.4; 2.35.7; 2.34.9
• Cloudflare — Cloudflare CDN / Load Balancer
  Vulnerable versions: N/A (infrastructure configuration compromise)
  Fixed in: N/A (rotated API key, removed rogue IPs)

Timeline

Last updated 2026-10-28 · revalidated 1× · latest source

• 2026-08-28 Attacker registered lookalike domain locked-ioc-10 via registrar Trustname.com (Fewmoretaps OU), using Cloudflare nameservers leah.ns.cloudflare.com and matias.ns.cloudflare.com
• 2026-08-31 Coder identified and fully remediated the issue at 21:45 UTC; rogue IPs removed from the Cloudflare pool, cache cleared, and registry.coder.com confirmed clean
• 2026-08-31 Stolen credentials exfiltrated via HTTP to locked-ioc-7 with X-CLI-Token header
• 2026-08-31 Malicious scripts scanned for and exfiltrated cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials, environment variables, config files, terminal history, OIDC tokens, and SSH keys
• 2026-08-31 Users who created/updated templates, ran dry-runs, or built workspaces (with module caching disabled) received poisoned modules; the Terraform data 'external' 'telemetry' block invoked locked-ioc-13 and locked-ioc-12 at provision time
• 2026-08-31 Malicious registry serving window began at 07:35 UTC: Cloudflare began routing a subset of registry requests to attacker-controlled servers hosting tampered Terraform modules
• 2026-08-31 Attacker added unauthorized IP addresses (including locked-ioc-11) to the Cloudflare origin pool serving registry.coder.com
• 2026-08-31 Attacker compromised a Coder Cloudflare API key with administrative access to Coder's Cloudflare infrastructure
• 2026-09-01 Coder released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 with automatic cache-purge remediation
• 2026-09-01 Coder published GitHub Security Advisory GHSA-vx42-ghc9-gw65 (CVSS 9.0 Critical) and blog post detailing the incident, IOCs, and remediation steps
• 2026-09-02 Coder adds details of the data exfiltration scenario to advisory GHSA-vx42-ghc9-gw65.
• 2026-09-03 BleepingComputer, SecurityOnline, and other security outlets published coverage of the supply-chain attack
• 2026-09-07 Cloud Security Alliance research note details the attack chain and the exfiltration endpoint.
• 2026-09-24 Coder adds a changelog section to the advisory.

Update history

• 2026-10-28 — Coder Module Registry Compromise Leads to Credential-Stealing Malware Distribution (GHSA-vx42-ghc9-gw65): What changed No field escalation. The newer report lists status PATCHED versus the existing ACTIVE; this is not applied because it would not be an escalation and the existing record is left unchanged.

Sources cited

• GitHub Security Advisory GHSA-vx42-ghc9-gw65 GitHub · Advisory · 2026-09-01
• Wiz Threats: Coder Module Registry Compromise Wiz · Advisory · 2026-09-01
• Coder Blog: Registry Security Incident coder.com · Vendor report · 2026-09-01
• Optimus Labs: When the Supply-Chain Attack Has No CVE optimuslabs.io · Research · 2026-09-02
• BleepingComputer: Coder's Registry Infrastructure Compromised BleepingComputer · News · 2026-09-03
• SecurityOnline: Coder Registry Supply Chain Attack securityonline.info · News · 2026-09-03
• Protect.computer: Coder Registry Terraform Supply Chain protect.computer · News · 2026-09-03

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

Previous and next in supply chain

• Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks Previous report
• GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages