Rogue IPs added to Coder's Cloudflare pool served credential-stealing Terraform modules for 14 hours

Origin pool membership is a write operation on the CDN account, not on the origin host. Per Coder's advisory, the actor added unauthorized IP addresses to the pool Cloudflare uses for the module registry ^[1]. The substitution happened at the layer that decides which origin answers, so from the client side the hostname and the TLS front end were the same ones the build used yesterday, with no server compromise and no forged certificate involved ^[20]. Cloudflare then routed some registry requests to the attacker's servers and delivered malicious files to a subset of users ^[2].

The window Coder gives is 07:35 UTC to 21:45 UTC on Monday, August 31 ^[4]. That is 14 hours 10 minutes, or 850 minutes of build traffic ^[19]. Terraform modules are prepackaged instructions for creating and configuring infrastructure ^[15], so what matters for any one deployment is how many workspace builds and provisioner runs landed inside that band, not how many developers are on the roster.

The stealer swept eight classes of secret ^[16]: provisioner environment variables, cloud and AI-tooling API keys, CI/CD credentials, configuration-file secrets and terminal history, user OIDC tokens, SSH keys, one-time external authentication tokens, and, when the provisioner ran inside coderd, Coder database passwords and other configuration secrets ^[5]. That last condition is the one to check first. It moves the loss from a workspace's credentials to the platform's own. Collected data went to the lookalike domain coder-infra[.]com ^[6]. Coder says refresh tokens were never passed to the provisioner and that it has no evidence of impact to customer data it holds ^[18].

The evidentiary problem is harder than the technical one. The attacker's infrastructure sits outside Coder's control, so Coder has no access to the delivery logs and cannot conclusively identify every compromised deployment ^[12]. Verification is therefore local work: egress records from firewall, proxy, DNS and VPC flow logs checked for coder-infra[.]com ^[9], provisioner logs searched for data.external.telemetry with the downloaded modules identified and cached packages purged ^[10], and the SQL query Coder published run against cached modules and template versions ^[11]. A clean result only means something if the retention covers August 31.

Fixes shipped across four release branches, 2.37.0, 2.36.4, 2.35.7 and 2.34.9 ^[8][17]. What those releases actually change is unspecified, and upgrading a version does not undo a stolen key; Coder's own instruction is to rotate everything on the list ^[7]. Coder's self-hosted development environments are run by Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government and defense contractors ^[13][14], each of which has to do that rotation itself.