Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)
Coder Module Registry Supply-Chain Compromise Distributes (TL-2026-2373), also tracked as Coder Registry Supply-Chain Attack, is a critical-severity supply-chain compromise scored CVSS 9, first published 2026-09-07. It has no confirmed attribution, affects Coder Coder (remote development platform), maps to 16 MITRE ATT&CK techniques (T1005, T1020, T1036.005), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-2373
- Threat ID
- TL-2026-2373
- Also known as
- Coder Registry Supply-Chain Attack, GHSA-vx42-ghc9-gw65
- Severity
- CRITICAL
- CVSS
- 9 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-07
- Last reviewed
- 2026-09-07
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, defense, finance, technology, automotive, retail
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 16
An unidentified attacker compromised a Coder Cloudflare API key on August 31, 2026, adding unauthorized IP addresses to the origin pool serving registry.coder.com. Over a ~14-hour window (07:35–21:45 UTC), a subset of users received tampered Terraform modules containing credential-stealing scripts (dlp.sh, dlp-docker.sh) that exfiltrated cloud infrastructure keys, AI-tooling API keys, CI/CD credentials, OIDC tokens, SSH keys, and terminal history to the lookalike domain coder-infra.com. The attack was rated CVSS 9.0 (Critical) under CVSS v4; no CVE was assigned. Coder released patched versions 2.37.0/2.36.4/2.35.7/2.34.9 on September 1, 2026.
How Coder Module Registry Supply-Chain Compromise Distributes works
On August 31, 2026, between 07:35 and 21:45 UTC, an unidentified threat actor compromised a Cloudflare API key belonging to Coder, the remote-development platform. Using this compromised key, the attacker added rogue IP addresses—including 199.91.220.205—to the Cloudflare origin pool behind Coder's module registry hostname, registry.coder.com. This caused Cloudflare's load balancer to route a subset of legitimate registry requests to attacker-controlled servers hosting a tampered copy of the Coder Terraform module registry.
Users who created or updated templates, ran template dry-runs, or built workspaces (with module caching disabled) during the exposure window received poisoned Terraform modules. These modules contained a Terraform data "external" "telemetry" block that invoked bundled shell scripts—dlp.sh (five variants targeting common, aider, rstudio-server, windows-rdp, and zed environments) and dlp-docker.sh—at provision time. The scripts scanned the host for credentials and secrets, including cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials and Git tokens, environment variables, configuration files, and shell history (bash_history). For workspace builds, the provisioner also exposed the user's OIDC token, SSH key, and single-use external-auth tokens (GitHub, GitLab, Bitbucket). Where the provisioner ran inside coderd rather than as a separate service, the database password and deployment configuration variables were also exposed.
Exfiltrated data was sent via HTTP to the lookalike domain coder-infra.com (registered three days prior, on August 28, 2026, via registrar Trustname.com / Fewmoretaps OU, using Cloudflare nameservers leah.ns.cloudflare.com and matias.ns.cloudflare.com), specifically to the endpoint http://www.coder-infra.com/cli/check, authenticated with the header X-CLI-Token.
Coder disclosed the incident on September 1, 2026 via GitHub Security Advisory GHSA-vx42-ghc9-gw65 (CVSS 9.0 Critical under CVSS v4.0) and released patched builds for versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. No CVE was assigned, as the compromise targeted delivery infrastructure rather than a code flaw. No evidence of compromise to Coder's own codebase, Google Cloud infrastructure, or customer data maintained by Coder was found. However, Coder stated it cannot conclusively identify every affected deployment because the attacker's infrastructure was outside Coder's control.
Coder's notable customers include the U.S. Department of Defense, Palantir, Dropbox, Discord, Square, Mercedes-Benz, and KKR (which led a $90M Series C in April 2026). The incident highlights a fundamental supply-chain gap: domain allowlisting and version pinning were ineffective because the legitimate domain itself served the malicious artifacts. Standard defenses—SBOM/AIBOM inventories, package cooldown windows, and checksum verification—did not trigger because no new packages were published and no code flaws were involved, only infrastructure manipulation.
MITRE ATT&CK techniques used in TL-2026-2373
Collection
Exfiltration
T1020 Automated Exfiltration; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1078 Valid Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.003 Shell History; T1552.004 Unsecured Credentials: Private Keys
defense-impairment
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1584.001 Compromise Infrastructure: Domains; T1587.001 Develop Capabilities: Malware
Affected products and versions in Coder Module Registry Supply-Chain Compromise Distributes
- Coder — Coder (remote development platform)
Vulnerable versions: <2.37.0; 2.34.x before 2.34.9; 2.35.x before 2.35.7; 2.36.x before 2.36.4
Fixed in: 2.37.0; 2.36.4; 2.35.7; 2.34.9 - Cloudflare — Cloudflare CDN / Load Balancer
Vulnerable versions: N/A (infrastructure configuration compromise)
Fixed in: N/A (rotated API key, removed rogue IPs)
Remediation for Coder Module Registry Supply-Chain Compromise Distributes
Patches
- Upgrade Coder to v2.37.0, v2.36.4, v2.35.7, or v2.34.9
Immediate actions
- Review firewall, proxy, DNS, and VPC flow logs for outbound traffic to coder-infra.com or 199.91.220.205
- Search provisioner job logs for the sentinel string 'data.external.telemetry'
- Run Coder's SQL cache-purge query: remove cached modules fetched during the exposure window (created_by = '00000000-0000-0000-0000-000000000000', mimetype = 'application/x-tar', creation between 2026-08-31 07:35 and 2026-08-31 21:45 UTC)
- Upgrade Coder to patched versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9
- Rotate all credentials accessible from affected provisioners: cloud API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD tokens, Git tokens, container registry credentials, Coder API session tokens, SSH keys, OIDC tokens, kubeconfigs
Workarounds
- Enable Terraform module caching (default behavior provides partial protection as cached safe copies are not re-fetched)
- Disable or restrict access to the module registry during incident investigation
Longer-term hardening
- Pin and cache Terraform modules through an internal mirror to decouple from upstream registry availability
- Scope provisioner credentials per template with short-lived tokens and least-privilege IAM roles
- Implement egress controls and behavioral monitoring: hostname allowlisting is insufficient when the payload arrives from the correct hostname
- Treat registry, CDN, and DNS infrastructure as critical trust boundaries in supply-chain risk assessments
- Add checksum verification for registry modules in .terraform.lock.hcl
Timeline of Coder Module Registry Supply-Chain Compromise Distributes
- Attacker registered lookalike domain coder-infra.com via registrar Trustname.com (Fewmoretaps OU), using Cloudflare nameservers leah.ns.cloudflare.com and matias.ns.cloudflare.com
- Coder identified and fully remediated the issue at 21:45 UTC; rogue IPs removed from the Cloudflare pool, cache cleared, and registry.coder.com confirmed clean
- Stolen credentials exfiltrated via HTTP to http://www.coder-infra.com/cli/check with X-CLI-Token header
- Malicious scripts scanned for and exfiltrated cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials, environment variables, config files, terminal history, OIDC tokens, and SSH keys
- Users who created/updated templates, ran dry-runs, or built workspaces (with module caching disabled) received poisoned modules; the Terraform data 'external' 'telemetry' block invoked dlp.sh and dlp-docker.sh at provision time
- Malicious registry serving window began at 07:35 UTC: Cloudflare began routing a subset of registry requests to attacker-controlled servers hosting tampered Terraform modules
- Attacker added unauthorized IP addresses (including 199.91.220.205) to the Cloudflare origin pool serving registry.coder.com
- Attacker compromised a Coder Cloudflare API key with administrative access to Coder's Cloudflare infrastructure
- Coder released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 with automatic cache-purge remediation
- Coder published GitHub Security Advisory GHSA-vx42-ghc9-gw65 (CVSS 9.0 Critical) and blog post detailing the incident, IOCs, and remediation steps
- BleepingComputer, SecurityOnline, and other security outlets published coverage of the supply-chain attack
Sources cited for Coder Module Registry Supply-Chain Compromise Distributes
- GitHub Security Advisory GHSA-vx42-ghc9-gw65
- Coder Blog: Registry Security Incident
- Wiz Threats: Coder Module Registry Compromise
- BleepingComputer: Coder's Registry Infrastructure Compromised
- Optimus Labs: When the Supply-Chain Attack Has No CVE
- SecurityOnline: Coder Registry Supply Chain Attack
- Protect.computer: Coder Registry Terraform Supply Chain
More in supply chain
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
- OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on RubyDoc.info Build Servers
- GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw
- Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks
- Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception
Detection coverage for TL-2026-2373
As of 2026-09-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2373 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.