[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKDRGq1BrB5GLFypZiB2bx8LellvxzW_UcbZg8qxVtR8":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"ea0d0b83-afd6-4981-a48f-44108f8cbbc8","Coder's registry infrastructure compromised to push malicious modules","coder-s-registry-infrastructure-compromised-to-push-malicious-modules-25f09a","Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. [...]","Attackers gained access to Coder's Cloudflare infrastructure and added unauthorized servers to its module registry. These servers delivered malicious Terraform modules containing credential-stealing code to some users between August 31st and September 1st, 2026. The stolen information included API keys, CI\u002FCD credentials, and other secrets, which were exfiltrated to the domain 'coder-infra[.]com'.","Attackers compromised Coder's infrastructure to distribute malicious Terraform modules.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcoders-registry-infrastructure-compromised-to-push-malicious-modules\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F03\u002F0_coder.jpg","2026-09-03T20:04:24+00:00","2026-09-03T22:00:19.793369+00:00",8,[17,20,23,26],{"name":18,"type":19},"Terraform modules","product",{"name":21,"type":22},"Cloudflare","vendor",{"name":24,"type":25},"Cloud development environments","technology",{"name":27,"type":25},"CI\u002FCD","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"domain","coder-infra[.]com","Exfiltration domain for stolen credentials.",[21,18],{"controls":58,"vendors":139},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":50,"name":89,"problem":90,"products":91},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[92,100,105],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":101,"product_name":102,"url":103,"description":104},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":114,"name":115,"problem":116,"products":117},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":163},"compromised-registry-infrastructure-delivers-credential-stealing-terraform-modules","Compromised Registry Infrastructure Delivers Credential-Stealing Terraform Modules","Attackers gained unauthorized access to Coder's Cloudflare infrastructure and injected malicious servers into its module registry, turning a trusted software distribution channel into a credential-theft vector. This is a classic supply chain attack: users who believed they were consuming legitimate Terraform modules were instead executing code designed to exfiltrate API keys, CI\u002FCD secrets, and other sensitive credentials. The incident highlights how a single point of compromise in a trusted registry can cascade across every downstream user and pipeline. Stolen credentials from CI\u002FCD systems are especially dangerous because they can grant persistent, broad access to production environments long after the initial breach. Organizations must treat third-party module registries as untrusted until integrity is verified.",[150,151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","NIST SR-4: Provenance","NIST IR-6: Incident Reporting","SLSA Supply Chain Levels for Software Artifacts (Level 3+)","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach",{}]