Coder Cloudflare Compromise Delivers Backdoored Terraform Modules to Developers

Cloud development platform Coder confirmed an attacker breached its Cloudflare infrastructure to deploy rogue registry servers that served backdoored Terraform modules to developers. The modified modules contained info-stealing payloads configured to extract cloud API keys, SSH keys, OpenID Connect tokens, and CI/CD pipeline secrets before transmitting them to an external server. Coder issued security updates across versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, urging teams that retrieved modules during the 14-hour incident window on August 31 to rotate all exposed credentials.

Attackers Injected Rogue Origins into Module Delivery Routing

The compromise targeted the infrastructure behind Coder’s public registry, the repository developers use to source building blocks for provisioning remote development workspaces. According to the company’s security disclosure, an attacker gained access to Coder’s Cloudflare account and added unauthorized IP addresses directly into the backend origin pool that serves registry.coder.com.

Cloudflare sits in front of the registry as a reverse proxy and content delivery network, distributing incoming traffic across healthy origin servers. Because the attacker inserted rogue servers directly into this trusted routing pool, Cloudflare began directing legitimate developer download requests to the attacker’s machines.

The rogue servers delivered modified versions of standard Terraform modules. Terraform modules are reusable packages of Infrastructure-as-Code configuration files that define how cloud computing resources, virtual machines, and network boundaries should be created. When developers ran commands to pull modules from the official registry hostname, their local environments executed the attacker’s altered code instead of authentic upstream packages.

The unauthorized routing remained active across an exposure window of approximately 14 hours on August 31, running between 07:35 UTC and 21:45 UTC.

How the Malicious Modules Targeted Environment Secrets

Once downloaded into a developer or workspace provisioning environment, the backdoored modules executed scripts designed to sweep the host system for sensitive credentials. The scripts gathered data from local environment variables, shell history files, and configuration paths before exfiltrating the contents to an external server controlled by the attacker.

The malicious code specifically targeted:

• Cloud infrastructure API keys and platform access tokens
• Configured SSH private keys used for server authentication
• OpenID Connect (OIDC) authentication tokens
• Continuous integration and continuous delivery (CI/CD) pipeline secrets
• Internal database passwords and configuration secrets when provisioners ran inside the core platform service

In cloud engineering workflows, OIDC tokens allow automated systems to authenticate with cloud platforms without storing hardcoded passwords. CI/CD pipeline secrets grant deployment scripts the authority to build, test, and release software automatically. By harvesting these credentials alongside SSH keys and cloud API tokens, the payload gathered the access keys required to authenticate directly to an organization’s downstream cloud providers.

Affected Releases and Required Remediation Steps

Coder updated its release channels to address the integrity of its registry configurations and workspace provisioners. The company made patches available across four supported release tracks:

• 2.37.0
• 2.36.4
• 2.35.7
• 2.34.9

The advisory stated that while Coder removed the rogue server addresses from its Cloudflare origin pool to halt further distribution, the company cannot independently verify every endpoint that received backdoored files while the attacker’s servers were active.

Organizations that pulled Terraform modules from the Coder registry during the 14-hour window on August 31 were instructed to purge local module caches, inspect outbound network logs for unauthorized data transfers, and immediately rotate any cloud credentials, API tokens, or SSH keys present in their workspace provisioning environments.