Coder Registry Infrastructure Served Malicious Modules

What happened

Coder reported that an unidentified actor gained access to its Cloudflare infrastructure and added unauthorized addresses to the pool serving its module registry. During a bounded 31 August UTC window, those servers delivered modified artifacts to a subset of users.

Technical mechanism

The malicious registry artifacts searched provisioner or workspace environments for secrets and exfiltrated them to the lookalike domain coder-infra.com. Risk depended on module downloads, cache state, template operations, and workspace builds during the exposure window.

Why it matters

The incident showed how compromise of trusted developer-delivery infrastructure can expose cloud, CI/CD, AI-tooling, workspace, and application credentials even when the underlying open-source project remains legitimate.

Impact

Potentially exposed material included environment variables, configuration data, terminal history, cloud and CI/CD credentials, AI-tooling keys, Git credentials, workspace tokens, and in some deployment modes application or database secrets. Coder stated it had no indication that customer data maintained by Coder was affected.

Response

Coder reviewed the registry, issued patched releases, published indicators and SQL investigation queries, advised cache clearing, and instructed potentially affected operators to rotate reachable credentials.

Defensive lessons

• Monitor the integrity and network path of package and module delivery infrastructure
• Treat provisioners and developer workspaces as high-value secret-bearing systems
• After a supply-chain exposure, investigate historical downloads and rotate all credentials reachable during execution

Evidence register

1. Coder — Malicious Packages Served from Unauthorized Registry Server (verified)