Coder's registry infrastructure compromised to push malicious modules

Attackers gained unauthorized access to Coder's Cloudflare infrastructure and injected malicious servers into its module registry, turning a trusted software distribution channel into a credential-theft vector. This is a classic supply chain attack: users who believed they were consuming legitimate Terraform modules were instead executing code designed to exfiltrate API keys, CI/CD secrets, and other sensitive credentials. The incident highlights how a single point of compromise in a trusted registry can cascade across every downstream user and pipeline. Stolen credentials from CI/CD systems are especially dangerous because they can grant persistent, broad access to production environments long after the initial breach. Organizations must treat third-party module registries as untrusted until integrity is verified.