Coder’s Cloudflare Setup Hijacked to Distribute Malicious Terraform Modules

Security researchers have confirmed that the cloud infrastructure of the DevOps platform Coder was breached, allowing attackers to insert rogue registry servers that served compromised Terraform modules. The malicious packages contained code designed to harvest credentials from users who downloaded and executed them.

The intrusion targeted Coder’s Cloudflare configuration, a service that routes traffic and provides DNS and caching for the company’s public-facing services. By altering the Cloudflare settings, the threat actors were able to redirect requests for registry resources to servers under their control, effectively inserting a supply‑chain attack vector into the software development workflow.

Analysis of the malicious modules shows they embed scripts that search for environment variables, configuration files, and other common storage locations for cloud and API keys. Once collected, the data is exfiltrated to an external endpoint operated by the attackers. The modules are packaged to appear as legitimate Terraform extensions, increasing the likelihood that developers will incorporate them into infrastructure‑as‑code pipelines.

Coder has responded by revoking the compromised registry entries, resetting affected keys, and working with Cloudflare to restore the integrity of its DNS and routing settings. The company also issued a security advisory urging users to verify the source of any Terraform modules they download and to rotate any credentials that may have been exposed.

Supply‑chain attacks on infrastructure‑as‑code tools have risen in recent months, as threat actors recognize the broad impact of compromising code that automates cloud deployments. By injecting malicious code at the module level, attackers can potentially gain footholds across multiple organizations that rely on shared resources, amplifying the reach of a single breach.

Experts recommend that organizations adopt strict verification practices, such as using signed modules, maintaining a whitelist of trusted registries, and employing automated scanning tools to detect anomalous behavior in code repositories. Continuous monitoring of network traffic for unexpected outbound connections can also help identify credential exfiltration attempts early.

The incident underscores the importance of securing the underlying infrastructure that supports developer tools. As more teams adopt cloud‑native workflows, ensuring the integrity of the services that deliver code and dependencies becomes a critical component of overall cybersecurity posture.