Attackers compromised **Coder**'s **Cloudflare** infrastructure, adding unauthorized registry servers that pushed malicious **Terraform** modules containing credential-stealing code. The **Coder** platform is widely used by prominent private and government organizations, including **Dropbox**, **Palantir**, **Square**, **Mercedes-Benz**, **KKR**, **EnBW**, the **U.S. government**, and defense companies, to provide secure, self-hosted cloud development environments for building and deploying software, including AI applications.  Earlier this week, **Coder** disclosed that an attacker targeted `registry.coder.com`, the project's package-hosting site used by developers to source components for their workspace templates. Despite **Coder**'s registry running behind **Cloudflare**, the attacker gained access to its underlying infrastructure and added unauthorized servers to the registry's pool. Consequently, **Cloudflare** routed some registry requests to the attacker’s servers instead of **Coder**’s legitimate servers, leading to the delivery of malicious files to a subset of users. “An unidentified malicious actor gained access to **Coder**’s **Cloudflare** infrastructure and added unauthorized IP addresses to the pool used for **Coder**’s module registry,” states **Coder**’s advisory. “These unauthorized IP addresses hosted a version of **Coder**’s registry that contained artifacts which included malicious code.” The project confirmed that the window for delivering these malicious artifacts was between 07:35 UTC and 21:45 UTC on Monday, August 31. During this period, the malicious servers distributed modified versions of **Terraform** modules, which are pre-packaged instructions for creating and configuring computing infrastructure. According to **Coder**, the malicious modules functioned as information stealers on infected hosts, specifically targeting: * Provisioner environment variables and secrets * Cloud infrastructure and AI-tooling API keys * CI/CD credentials * Configuration-file secrets and terminal history * User OIDC tokens * Configured SSH keys * One-time external authentication tokens * **Coder** database passwords and other configuration secrets when the provisioner ran within ‘coderd’ The stolen information was then exfiltrated to the lookalike domain `coder-infra[.]com`. **Recommendations for Impacted Users** It is highly recommended that potentially impacted users rotate all affected secrets mentioned in the list above as soon as possible. Before upgrading to a patched release (versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9), **Coder** advises users to examine firewall, proxy, DNS, and VPC flow logs for any connections to `coder-infra[.]com`. Developers should also search provisioner logs for `data.external.telemetry`, identify modules downloaded during the exposure window, and purge any potentially malicious cached packages. To assist users in determining if they were affected, **Coder** has provided an **SQL** query that can identify potentially compromised cached modules and template versions. **Coder** has stated that refresh tokens were not passed to the provisioner and that there is no evidence of any impact on customer data maintained by them. However, as the attacker’s infrastructure is beyond **Coder**'s control, the company lacks access to crucial logs and cannot conclusively identify every compromised deployment.