Reported by 2 outlets

Timeline

1. original reporting

   Hackers Compromise Coder Module Registry to Serve Malicious Packages and Steal Credentials

   cyberpress.org · 35d ago · September 8th, 2026

   Coder has disclosed a critical supply-chain compromise after an unidentified threat actor gained access to its Cloudflare infrastructure and inserted unauthorized IP addresses into the pool serving the company’s module registry. The intrusion allowed a malicious registry server to distribute trojanized Coder artifacts to a subset of users, potentially exposing cloud, CI/CD , AI tooling, and user authentication credentials. The incident affected users of the primary Coder module registry, registry.coder.com , who downloaded or updated Terraform-based template components during a limited exposure window on August 31, 2026, between 07:35 UTC and 21:45 UTC. Hackers Compromise Coder Module Registry Coder said it has no evidence that customer data maintained by the company was accessed or impacted. The malicious packages contained code designed to discover credentials available in the affected environment and send them to an attacker-controlled lookalike domain, coder-infra[.]com . The domain closely resembles legitimate Coder infrastructure naming and was reportedly registered on August 28, shortly before the compromise. The compromised modules used a Terraform data "external" "telemetry" block to execute a malicious script named dlp-docker.sh . The script was configured to contact http://www[.]coder-infra[.]com/cli/check and transmit data using an X-CLI-Token HTTP header, creating a direct mechanism for harvesting and exfiltrating sensitive deployment data. Coder warned that the

2. update from gbhackers.com

   Hackers Hijack Coder Module Registry to Distribute Credential-Stealing Malicious Packages

   gbhackers.com · 35d ago · September 8th, 2026

   Coder has reported a significant software supply chain incident in which an unidentified threat actor redirected part of its official module registry traffic to attacker-controlled infrastructure. This led to the temporary distribution of tampered Terraform modules intended to steal credentials. The incident affected the registry at registry.coder.com on August 31, 2026, between 07:35 UTC and […] The post Hackers Hijack Coder Module Registry to Distribute Credential-Stealing Malicious Packages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .