Coder Registry CDN Hijack Delivers Malicious Terraform Modules to Exfiltrate Cloud Secrets

Security reports have revealed details of a targeted supply-chain intrusion against the Coder Terraform module registry (registry.coder.com). Attackers gained unauthorized access to the underlying Cloudflare edge infrastructure and added rogue IP addresses into the official domain's routing pool. Over a 14-hour window, legitimate registry requests were intermittently intercepted and served modified Terraform modules containing a secret-stealing payload. The malware operated via Terraform's data "external" block and helper shell scripts, harvesting environment variables, command history, cloud provider credentials, SSH keys, and active OIDC tokens directly from developer workspaces and pipeline runners. This incident is significant because it completely bypassed standard perimeter defenses and zero-trust transport checks. Because the attack manipulated CDN routing rather than relying on typosquatting or fraudulent domain names, automated workflows downloading modules over HTTPS from the verified hostname received weaponized payloads without throwing TLS or DNS warnings. Any organization running un-cached workspace builds or initializing new templates during the exposure window was exposed to credential harvesting with the full access permissions of the provisioning execution context. This breach reflects a broader trend where attackers increasingly target developer toolchains and Infrastructure-as-Code pipelines as high-leverage entry points into cloud environments. As organizations adopt cloud development environments and ephemeral workspace automation, developer machines and CI/CD runners aggregate sensitive secrets, cloud API keys, and repository write permissions. While container registries and package managers in other ecosystems have moved toward mandatory cryptographic signing and immutable lockfile integrity, module distribution mechanisms in the Terraform ecosystem remain uniquely susceptible when edge delivery layers are breached. In practice, DevOps and platform teams must immediately review network egress and DNS logs for anomalous outbound connections originating from Terraform and workspace provisioning hosts. Teams should move away from dynamically pulling modules from upstream endpoints during runtime, instead enforcing local module caching, private mirror artifact repositories, and strict version pinning. Furthermore, platform administrators should leverage policy-as-code and static analysis tooling to flag or disable unvetted data "external" blocks and restrict runner privileges to minimize blast radius during execution.