# Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)

> An unidentified attacker compromised a Coder Cloudflare API key on August 31, 2026, adding unauthorized IP addresses to the origin pool serving registry.coder.com. Over a ~14-hour window (07:35–21:45 UTC), a subset of users received tampered Terraform modules containing credential-stealing scripts (dlp.sh, dlp-docker.sh) that exfiltrated cloud infrastructure keys, AI-tooling API keys, CI/CD credentials, OIDC tokens, SSH keys, and terminal history to the lookalike domain coder-infra.com. The attack was rated CVSS 9.0 (Critical) under CVSS v4; no CVE was assigned. Coder released patched versions 2.37.0/2.36.4/2.35.7/2.34.9 on September 1, 2026.

- **Published:** 2026-09-07T00:00:00Z
- **Last reviewed:** 2026-09-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2373
- **ID:** TL-2026-2373
- **Severity:** CRITICAL (CVSS 9)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 31, 2026, between 07:35 and 21:45 UTC, an unidentified threat actor compromised a Cloudflare API key belonging to Coder, the remote-development platform. Using this compromised key, the attacker added rogue IP addresses—including 199.91.220.205—to the Cloudflare origin pool behind Coder's module registry hostname, registry.coder.com. This caused Cloudflare's load balancer to route a subset of legitimate registry requests to attacker-controlled servers hosting a tampered copy of the Coder Terraform module registry.

Users who created or updated templates, ran template dry-runs, or built workspaces (with module caching disabled) during the exposure window received poisoned Terraform modules. These modules contained a Terraform data "external" "telemetry" block that invoked bundled shell scripts—dlp.sh (five variants targeting common, aider, rstudio-server, windows-rdp, and zed environments) and dlp-docker.sh—at provision time. The scripts scanned the host for credentials and secrets, including cloud infrastructure API keys (AWS, GCP, Azure), AI-tooling API keys (Anthropic, OpenAI), CI/CD credentials and Git tokens, environment variables, configuration files, and shell history (bash_history). For workspace builds, the provisioner also exposed the user's OIDC token, SSH key, and single-use external-auth tokens (GitHub, GitLab, Bitbucket). Where the provisioner ran inside coderd rather than as a separate service, the database password and deployment configuration variables were also exposed.

Exfiltrated data was sent via HTTP to the lookalike domain coder-infra.com (registered three days prior, on August 28, 2026, via registrar Trustname.com / Fewmoretaps OU, using Cloudflare nameservers leah.ns.cloudflare.com and matias.ns.cloudflare.com), specifically to the endpoint http://www.coder-infra.com/cli/check, authenticated with the header X-CLI-Token.

Coder disclosed the incident on September 1, 2026 via GitHub Security Advisory GHSA-vx42-ghc9-gw65 (CVSS 9.0 Critical under CVSS v4.0) and released patched builds for versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. No CVE was assigned, as the compromise targeted delivery infrastructure rather than a code flaw. No evidence of compromise to Coder's own codebase, Google Cloud infrastructure, or customer data maintained by Coder was found. However, Coder stated it cannot conclusively identify every affected deployment because the attacker's infrastructure was outside Coder's control.

Coder's notable customers include the U.S. Department of Defense, Palantir, Dropbox, Discord, Square, Mercedes-Benz, and KKR (which led a $90M Series C in April 2026). The incident highlights a fundamental supply-chain gap: domain allowlisting and version pinning were ineffective because the legitimate domain itself served the malicious artifacts. Standard defenses—SBOM/AIBOM inventories, package cooldown windows, and checksum verification—did not trigger because no new packages were published and no code flaws were involved, only infrastructure manipulation.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1584.001 Compromise Infrastructure: Domains
- T1587.001 Develop Capabilities: Malware
- T1078 Valid Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1204.002 User Execution: Malicious File
- T1553 Subvert Trust Controls
- T1036.005 Match Legitimate Resource Name or Location
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.003 Shell History
- T1552.004 Unsecured Credentials: Private Keys
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1020 Automated Exfiltration

## Sources

- [GitHub Security Advisory GHSA-vx42-ghc9-gw65](https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65)
- [Coder Blog: Registry Security Incident](https://coder.com/blog/coder-registry-security-incident-what-happened-and-what-to-do)
- [Wiz Threats: Coder Module Registry Compromise](https://threats.wiz.io/all-incidents/coder-module-registry-compromise-leads-to-credential-stealing-malware-distribution)
- [BleepingComputer: Coder's Registry Infrastructure Compromised](https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/)
- [Optimus Labs: When the Supply-Chain Attack Has No CVE](https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack)
- [SecurityOnline: Coder Registry Supply Chain Attack](https://securityonline.info/coder-registry-supply-chain-attack/)
- [Protect.computer: Coder Registry Terraform Supply Chain](https://protect.computer/news/2026-09-03-coder-registry-terraform-supply-chain/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2373