Coder provides self-hosted cloud development environments. Its customer list includes Dropbox, Palantir, Square, Mercedes-Benz and US government agencies.

On 31 August 2026, between 07:35 and 21:45 UTC, some requests to registry.coder.com — where developers pull Terraform modules for workspace templates — were answered by servers the attacker controlled.

The packages were never modified

This is the part that makes it different from an ordinary supply-chain compromise.

Attackers got into Coder's Cloudflare infrastructure and added unauthorised IP addresses to the origin pool for the module registry. Cloudflare then did exactly what it is supposed to do: it routed requests to origins in the pool. Some of those origins were not Coder's.

Nothing at source changed. The repository is intact. Version numbers are intact. Whatever integrity you could verify about the published artifact would have verified correctly, because the published artifact was never the problem — the thing you received was never the published artifact.

That defeats a whole category of controls. Signature checks, hash pinning, package reputation, "did the maintainer publish this" — all of them answer a question about the publisher. None of them answers "did this byte stream actually come from the publisher's server".

Poisoned LiteLLM releases reaching 2,500 organisations worked the old way, by changing what was published. This is the layer underneath.

"Some" requests

The word to sit with is some. Routing to an origin pool is load balancing, so which requests hit the attacker's servers was not deterministic.

You therefore cannot check whether you were affected by looking at a version number, and neither can Coder. Two engineers on the same team, pulling the same module in the same hour, could have received different bytes.

What it took

The injected code was an information stealer, and the target list is a good description of what a developer workstation actually holds:

  • Provisioner environment variables and secrets
  • Cloud infrastructure and AI tooling API keys
  • CI/CD credentials
  • SSH keys and terminal history
  • OIDC tokens
  • Database passwords and configuration secrets

Exfiltration went to coder-infra[.]com, a lookalike domain.

Terminal history is the entry worth pausing on. It is where people paste a token once to test something, where a one-off credential gets typed with a password on the command line, where the thing that never made it into a secret manager is nonetheless written down. It is rarely rotated because it is rarely thought of as a credential store.

Coder cannot tell you if you were hit

The company says it lacks crucial logs from the attacker's infrastructure, and therefore cannot definitively identify which deployments were affected. It has not published which modules were touched or how many users pulled them.

Read the guidance in that light. "Rotate all credentials and check your network logs for connections to the lookalike domain" is not caution — it is the only instruction available when the incident cannot be scoped.

Patched versions are 2.37.0, 2.36.4, 2.35.7 and 2.34.9.

What to do

  • Rotate everything a Coder provisioner could see, on the assumption you were affected. There is no way to establish that you were not.
  • Search outbound logs for coder-infra[.]com across 31 August. That is the one hard indicator published.
  • Treat shell history as a credential store. Clear it on build agents, and rotate anything you know was ever typed rather than referenced.
  • Ask where your artifacts are actually served from. Registry integrity is usually reasoned about at the repository; this incident happened between the repository and you.
  • Check whether your CDN account has the same protections as your source control. Origin pool membership is a deployment primitive, and on most teams it is guarded far less carefully than a signing key.

What is not established

  • Which modules were affected, or how many downloads.
  • How the Cloudflare account was compromised. Not disclosed.
  • Whether any credentials were used after exfiltration.
  • How many of the named customers pulled modules in the window. Nobody has said.
  • Whether the missing logs will ever be recovered. Coder describes them as absent, not delayed.