Optimus Labs logo
All briefings
Optimus Labs · CivilizationsCRITICAL · CVSS 9.0 (no CVE)

When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack

Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.

Supply chainVendor breachCoding agentSCSupply Chain nth Party RiskAIAI Asset Supply Chain SecurityALAgentware Lifecycle SecurityAPAgent Permissions

Full advisory deck

Credential providers at risk

CoderCoder
CloudflareCloudflare
Amazon Web ServicesAWS
Google CloudGCP
Microsoft AzureAzure
AnthropicAnthropic
OpenAIOpenAI
GitHubGitHub
GitLabGitLab
BitbucketBitbucket

Key takeaways

3 min read
  • A 14-hour takeover of the Cloudflare pool behind registry.coder.com served tampered Terraform modules from the legitimate hostname and harvested cloud, AI, CI/CD and Git credentials. Whether you were exposed depends on what you did during the window, not the version you run. There is no CVE and no vulnerability-feed entry.
  • Blast radius: Any Coder deployment that pulled a registry module during the window. Because Coder runs cloud development environments and autonomous AI coding agents on customer infrastructure, the provisioner and workspaces hold cloud keys (AWS, GCP, Azure), AI-tooling keys (Anthropic, OpenAI), CI/CD and Git tokens, and SSH credentials.
  • CRITICAL · CVSS 9.0 (no CVE)

Timeline

  1. Domain registered

    coder-infra.com is registered

  2. Rogue IPs serve malware

    Unauthorised IPs added to the registry.coder.com Cloudflare pool

  3. Serving stops

    Roughly a 14-hour window

  4. Advisory + patched builds

    Coder publishes GHSA-vx42-ghc9-gw65 and patched builds

Blast radius
Any Coder deployment that pulled a registry module during the window. Because Coder runs cloud development environments and autonomous AI coding agents on customer infrastructure, the provisioner and workspaces hold cloud keys (AWS, GCP, Azure), AI-tooling keys (Anthropic, OpenAI), CI/CD and Git tokens, and SSH credentials.
Classifiers
SC: Supply Chain nth Party Risk · AI: AI Asset Supply Chain Security · AL: Agentware Lifecycle Security · AP: Agent Permissions

Summary

Between 07:35 and 21:45 UTC on August 31, 2026, an attacker added unauthorized IP addresses to the Cloudflare pool behind registry.coder.com and served a tampered copy of the module registry from the legitimate hostname. The poisoned modules ran dlp.sh / dlp-docker.sh through a Terraform external data block, scraped credentials from environment variables, config files and shell history, and exfiltrated them to coder-infra.com, a lookalike registered three days earlier. Coder disclosed it as GHSA-vx42-ghc9-gw65 (CVSS 9.0) the next day.

Am I affected?

Any single yes means treat this as an incident.

Answer this in about a minute

We built leakpatrol to answer exactly this question. It checks your Coder deployment, your provisioners, your images and your egress logs against every indicator below, and tells you which exposure path applies and what to rotate. One static binary, no dependencies, read-only, Apache-2.0.

leakpatrol
leakpatrol all
View on GitHub
  • Did a Coder deployment create or update a template between 07:35 and 21:45 UTC on Aug 31, 2026?
  • Did anyone run a template dry-run in that window?
  • Did anyone deploy a workspace in that window with module caching disabled?

Not affected if

  • No template authoring, dry-run, or uncached workspace build in the window.
  • Workspaces built purely from an already-cached module set.
Patched builds2.37.02.36.42.35.72.34.9

An unpatched deployment that pulled nothing in the window is untouched. A patched deployment that pulled a module during it is not.

How the attack worked

  • The attacker never touched Coder's code. They took the delivery path: unauthorized IPs were added to the Cloudflare pool answering for registry.coder.com, and those rogue servers returned a tampered registry for fourteen hours.
  • The tampered modules carried two shell scripts, dlp.sh and dlp-docker.sh, invoked through a Terraform data "external" "telemetry" block at provision time. The scripts walked environment variables, config files and shell history for cloud, AI-tooling, CI/CD, Git, SSH and Kubernetes credentials, then shipped them to coder-infra.com, a lookalike registered three days earlier.
  • One detail decides everything: the malicious download came from the real domain. Most organizations touched by this were never targeted. If a deployment pulled a module in the window, the payload took whatever it could reach.

Why this lands on your AI stack

  • Coder is the platform enterprises use to run cloud development environments and, increasingly, autonomous AI coding agents on infrastructure they control. Its published customer stories include the U.S. Department of Defense, a defense-intelligence organization running 2,500+ developers, Palantir, Dropbox and Discord. At KKR, which led its $90M Series C in April 2026, more than half of all commits now happen inside Coder-managed environments with agents doing the work.
  • Those workspaces and their Terraform provisioners hold the secrets worth stealing: cloud keys for AWS, GCP and Azure; AI-tooling keys for Anthropic and OpenAI; CI/CD tokens; Git and SSH credentials. When an agent runs inside a Coder workspace, those keys are what it runs on. Harvest the provisioner and you have harvested the estate.

Why nothing caught it, and why there is no CVE

  • Version pinning pins the version number, not the bytes. Unlike providers, registry modules are not checksum-locked in .terraform.lock.hcl, so a pinned version is re-fetched on trust and the registry served tampered bytes for that exact version.
  • Domain allowlisting saw registry.coder.com, the host you are required to trust. Cooldown and quarantine wait out new releases, and nothing new was published. Lockfiles and software-composition analysis match your dependency graph against known-bad versions and CVEs, and there were neither. SBOM and AIBOM inventories list models, datasets and libraries, not your development platform's CDN, registry and DNS, which is where this lived.
  • There is no CVE, no NVD entry, no OSV record. Infrastructure compromises are not code flaws, so they never enter the machinery your scanners subscribe to. Compare it with CVE-2026-46354, a CVSS 9.1 signature bypass Coder disclosed weeks earlier: CVE assigned, in NVD and OSV, analyzed by Orca, Snyk and Tenable within days. Same vendor, same month, entirely different visibility.
  • It also fits a run of recent Coder advisories that turn on trusting the Coder server itself: CVE-2026-44454, a one-click RCE through dotfiles modules, and CVE-2026-55427, where a compromised server injects a ProxyCommand that runs on the developer's own workstation. Different doors, same room.
  • Every one of those controls watches the artifact or the feed. None watches behavior at the point of execution, which is the only place this attack was visible.

What leaked, by path

If youAssume exposed
Created or updated a templateThe provisioner's own environment: cloud keys (AWS, GCP, Azure), AI-tooling keys (Anthropic, OpenAI), CI/CD tokens, anything in env vars, config files or shell history on that host.
Built a workspace (module caching off)Everything above, plus the user's OIDC token, their SSH key, and single-use external-auth tokens for GitHub, GitLab or Bitbucket.
Ran the provisioner inside coderdEverything above, plus your Coder database password and deployment configuration, per the advisory.

Remediation

Contain now · 0-24h
  • Search firewall, proxy, DNS and VPC flow logs for outbound traffic to coder-infra.com or 199.91.220.205 across the window and after.
  • Clear cached registry modules, and run the SQL query in Coder's advisory to identify and purge affected modules from your deployment cache.
  • Upgrade to a patched build: 2.37.0, 2.36.4, 2.35.7 or 2.34.9.
Investigate · assume breach · 24-72h
  • Treat every credential reachable from an affected provisioner as compromised and rotate it, cloud keys first: they unlock more than any single model or app.
  • Rotate in order: AWS / GCP / Azure, then Anthropic and OpenAI keys, then CI/CD and Git tokens, container registry credentials, Coder API session tokens, SSH keys and kubeconfigs.
  • Grep hosts and images for dlp.sh and dlp-docker.sh, and hunt provisioner job logs for the sentinel string data.external.telemetry (Coder publishes a query for this).
Harden strategically
  • Pin and cache modules through an internal mirror so a hijacked upstream host cannot serve you code directly.
  • Treat the provisioner as a secrets-bearing tier: scope its credentials per template, keep it out of coderd, and give it short-lived tokens.
  • Add egress control and behavioral monitoring around agent workspaces. A hostname allowlist does not help when the malicious payload arrives from the correct hostname; the exfiltration leg is where this class of attack becomes visible.

Leaked by association

EntityIdentifier
Cloud · AWSAWS_ACCESS_KEY_ID / _SECRET
Cloud · GCPGOOGLE_APPLICATION_CREDENTIALS
Cloud · AzureARM_CLIENT_ID / _SECRET
AI · AnthropicANTHROPIC_API_KEY
AI · OpenAIOPENAI_API_KEY
CI/CDpipeline / runner secrets
Git / VCSGITHUB_TOKEN / GITLAB_TOKEN
Container registryregistry login / creds
Coder APICODER_* session tokens
SSH / K8sSSH keys / kubeconfig

This list reflects what typically lives in a Coder provisioner or template, not a measured per-deployment inventory.

Indicators

  • domain: www[.]coder-infra[.]com (registered 2026-08-28)
  • ipv4: 199.91.220[.]205
  • file: dlp-docker.sh
  • file: dlp.sh (five variants observed)
  • sha256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398 (dlp-docker.sh)
  • artifact: Terraform data "external" "telemetry" block

MITRE ATT&CK

Sample output

The commands below work if you prefer to hunt by hand. leakpatrol runs all of them and grades what it finds by severity and exposure path: github.com/optimuslabs-io/leakpatrol

Threat Hunt commands
# Egress hunt across the window and after
grep -R "coder-infra\|199.91.220" /var/log 2>/dev/null

# Payload hunt on hosts and images
find / -name "dlp*.sh" 2>/dev/null

# Provisioner artifact in template sources
rg -n 'data "external" "telemetry"' .

Sources

Sourcing & confidence

Confirmed by the vendor

  • Window, affected access paths, IOCs, cache-purge query, rotation guidance and patched builds: Coder's advisory GHSA-vx42-ghc9-gw65 and its Discord announcement.
  • Coder reports no indication that customer data it maintains was impacted.
  • Security press pickup on Sep 3 (BleepingComputer, eSecurity Planet) relays the advisory: no CVE and no independent indicators.

Assessed by Civilizations

  • Still no CVE and no NVD or OSV entry. We ran every indicator across three independent search engines and VirusTotal, GreyNoise, AbuseIPDB, urlscan and MalwareBazaar: zero hits outside Coder's advisory and its mirrors (our check, Sep 1-4, 2026).
  • That silence is expected for a pull-based vendor-infrastructure attack with no inbound scanning component, not an all-clear.
  • MalwareBazaar samples named dvr.sh and dlr.spc from the same week are unrelated: different hashes, different family. Do not match on filename.
  • Template names (aider, zed, rstudio-server, windows-rdp) come from the advisory's hashed payload variant labels. Reading them as the specific poisoned templates is our inference.
  • Named organizations (U.S. Department of Defense, a defense-intelligence organization with 2,500+ developers, Palantir, Dropbox, Discord, KKR, QRT) come from Coder's published customer stories. They indicate the install base, not disclosed victims. No victim list has been published.
  • The credential inventory is inferred from what a Coder provisioner and templates typically hold.
  • No outside party has reproduced or observed these specific indicators; this is vendor-attested plus a tradecraft match to an active 2026 campaign class.

Vendor perspective · Optimus Labs

How Optimus Labs sees this class of incident

Coder is marketed as the secure way to provision AI infrastructure: cloud development environments and autonomous coding agents running on infrastructure the customer controls. The irony is that the same platform trusted to host AI workflows became the conduit. By hijacking Coder's own delivery infrastructure, the attacker did not need to breach a single customer directly; they poisoned the channel that provisions those environments and let customers pull the malicious modules themselves.

Because Coder workspaces run AI agents with cloud, AI-tooling, CI/CD and Git credentials in scope, the blast radius is not a Coder server compromise. It is the customers' own AI infrastructure: agent runners, cloud tenants, model endpoints and source repositories. The platform that was supposed to secure that stack became the supply chain that threatened it.

You cannot patch your way out of an attack that ships no patch, and you cannot scan for an indicator that never reaches your feed. The controls that catch this class do not look at CVEs or package hashes; they look at behavior: a workspace suddenly reading environment variables it never touched, then calling a domain it has never called.

That is what our endpoint sensor watches: what AI agents, MCPs and skills actually do at runtime, rather than waiting for a vulnerability feed to catch up. Credential harvesting inside a workspace followed by exfiltration to an unfamiliar host is the sequence an intent-aware control surfaces, CVE or not.

See it on your own stack

Related briefings

CRITICAL · AGENT COLLECTIVE

700 Agents. 4 Zero-Days. No Human.

OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox into Hugging Face production. The first agent-collective breach of a live third party.

Read
HIGH · ROGUE AI

One Untrusted String, Three Trust Boundaries

Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it.

Read

Full advisory

Download the briefing PDF

The complete advisory deck for this incident, with the attack chain diagram, indicators, and remediation bands in one file.

Optimus Labs · Civilizations

Get the next briefing first

Threat research, disclosures, and practical tips on enterprise Agentic AI attack surface management, directly in you or your agent's inbox.

Subscribe

Backed by

Benhamou Global Ventures
Arka
Executive Venture Fund
a16z Scout Fund
Scout
GitHub for Startups
AWS Activate