Coder's Terraform Module Registry Infrastructure Compromised to Distribute Credential-Stealing Code

According to BleepingComputer, attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. Details on the initial access vector, scope of affected users, and duration of exposure have not been fully disclosed at this time.

Why It Matters

Terraform modules run with the privileges of whoever executes them, typically within infrastructure-as-code pipelines that hold cloud provider credentials, secrets, and state files. A compromised module distribution channel is a supply-chain attack vector: organizations that pulled modules through Coder's registry during the compromise window may have unknowingly executed attacker-controlled code with access to sensitive credentials and cloud environments.

What Defenders Should Do

• Inventory any Terraform modules sourced from Coder's registry and review recent terraform plan/apply runs for unexpected providers, data sources, or outbound network calls.
• Rotate credentials (cloud provider keys, API tokens, secrets referenced in state files) that may have been exposed to CI/CD runners executing untrusted modules during the affected period.
• Audit CI/CD and Terraform runner logs for anomalous outbound connections, particularly to unfamiliar registry hostnames or IPs, around the time of the incident.
• Pin Terraform module sources to specific commit hashes or verified versions rather than floating references, and consider a private module mirror with integrity checks going forward.

This is developing, net-new intelligence with limited public detail so far — no CVE has been assigned and full scope/attribution has not been confirmed. For the latest reporting, see the original coverage at BleepingComputer.