Coder Registry Infrastructure Compromise and Supply Chain Attack

In late August 2026, the Coder development platform suffered a significant supply chain attack after unidentified actors gained unauthorized access to its Cloudflare infrastructure. The attackers injected rogue IP addresses into the registry pool for registry.coder.com, causing Cloudflare to route legitimate user requests to attacker-controlled servers. These rogue servers delivered backdoored Terraform modules containing information-stealing scripts during a specific exposure window on August 31, 2026.

The attack specifically targeted high-value technical artifacts, including cloud infrastructure API keys, CI/CD credentials, OIDC tokens, and SSH keys. Given that Coder is utilized by major government entities and defense industrial base companies, the potential for secondary compromise of cloud environments is high. Coder has released patched versions and specific remediation scripts to identify and purge malicious cached artifacts from local deployments.