# When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack
# Optimus Labs · Civilizations — https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack
# Published: 2026-09-01 | Severity: critical
# Affected: Coder, Cloudflare, AWS, GCP, Azure, Anthropic, OpenAI, GitHub, GitLab, Bitbucket
#
# Machine-readable siblings:
#   STIX 2.1: https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.stix.json
#   MISP event: https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.misp.json
#   Markdown: https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.md

## domain
www.coder-infra.com

## ipv4
199.91.220.205

## file
dlp-docker.sh
dlp.sh

## sha256
7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398

## ghsa
GHSA-vx42-ghc9-gw65

## narrative-indicators
# domain: www[.]coder-infra[.]com (registered 2026-08-28)
# ipv4: 199.91.220[.]205
# file: dlp-docker.sh
# file: dlp.sh (five variants observed)
# sha256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398 (dlp-docker.sh)
# artifact: Terraform data "external" "telemetry" block
# artifact: /cli/check request path, X-CLI-Token header
# advisory: GHSA-vx42-ghc9-gw65