CODER'S REGISTRY HACKED TO DISTRIBUTE MALWARE

The attackers gained access to Coder's infrastructure and added rogue registry servers to the system. These servers pushed compromised Terraform modules containing credential-stealing code to unsuspecting users downloading packages. Terraform modules are widely used for infrastructure-as-code deployments, making this a significant supply chain attack vector. Users who downloaded affected modules during the compromise window may have exposed sensitive credentials and authentication tokens. The breach highlights risks in dependency chains and the importance of verifying package sources. Coder has secured its infrastructure and notified affected users to rotate credentials and check for unauthorized access. Infrastructure-as-code tools have become increasingly targeted by threat actors due to their access to sensitive deployment credentials and cloud environments.