Coder's registry infrastructure compromised to push malicious modules
Attackers breached Coder's Cloudflare infrastructure and inserted unauthorized registry servers that served up malicious Terraform modules designed to steal credentials. The compromise affected the supply chain for infrastructure code that organizations use to build and manage cloud environments.
Why this matters: This is a supply chain attack aimed at the tools developers trust to build infrastructure. Terraform modules get pulled into automated pipelines and run with real permissions against real cloud accounts. If a module is compromised, the damage is not just one machine — it can be credentials, access keys, and control over cloud environments at scale. The hard part is that developers do not usually audit every module they pull. They trust the registry. When the registry itself is the attack surface, that trust becomes the vulnerability.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.