# When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack
> Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.
- **Publisher:** Optimus Labs · Civilizations
- **Published:** 2026-09-01
- **Severity:** CRITICAL · CVSS 9.0 (no CVE)
- **Types:** Supply chain, Vendor breach, Coding agent
- **Categories:** SC — Supply Chain nth Party Risk; AI — AI Asset Supply Chain Security; AL — Agentware Lifecycle Security; AP — Agent Permissions
- **Vendors / products affected:** Coder, Cloudflare, AWS, GCP, Azure, Anthropic, OpenAI, GitHub, GitLab, Bitbucket
- **Blast radius:** Any Coder deployment that pulled a registry module during the window. Because Coder runs cloud development environments and autonomous AI coding agents on customer infrastructure, the provisioner and workspaces hold cloud keys (AWS, GCP, Azure), AI-tooling keys (Anthropic, OpenAI), CI/CD and Git tokens, and SSH credentials.
- **Canonical URL:** https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack
## TL;DR

A 14-hour takeover of the Cloudflare pool behind registry.coder.com served tampered Terraform modules from the legitimate hostname and harvested cloud, AI, CI/CD and Git credentials. Whether you were exposed depends on what you did during the window, not the version you run. There is no CVE and no vulnerability-feed entry.

## Summary

Between 07:35 and 21:45 UTC on August 31, 2026, an attacker added unauthorized IP addresses to the Cloudflare pool behind registry.coder.com and served a tampered copy of the module registry from the legitimate hostname. The poisoned modules ran dlp.sh / dlp-docker.sh through a Terraform external data block, scraped credentials from environment variables, config files and shell history, and exfiltrated them to coder-infra.com, a lookalike registered three days earlier. Coder disclosed it as GHSA-vx42-ghc9-gw65 (CVSS 9.0) the next day.

## What happened

- Between 07:35 and 21:45 UTC on Aug 31, 2026, unauthorized IPs in the Cloudflare pool behind registry.coder.com served a tampered module registry from the legitimate hostname.
- Poisoned modules ran dlp.sh / dlp-docker.sh via a Terraform external data block, scraping credentials from env vars, config files and shell history and exfiltrating to coder-infra.com.
- Affected templates included aider, zed, rstudio-server and windows-rdp. Coder disclosed GHSA-vx42-ghc9-gw65 (CVSS 9.0) on Sep 1 with patched builds.

## Why it matters

- Coder runs cloud dev environments and autonomous AI coding agents on customer infrastructure, so its provisioner holds cloud, AI-tooling, CI/CD and Git credentials. Harvest the provisioner and you harvest the estate.
- There is no CVE, no NVD or OSV entry, and nothing for software-composition analysis to match: this was a delivery-infrastructure compromise, not a code flaw.
- The malicious artifact arrived from the trusted hostname, so version pinning and domain allowlisting were both no-ops. Only behavior distinguished the attack: credential access followed by an unfamiliar egress destination.

## What to do

- Check what you did during the window: template create/update, dry-run, or uncached workspace build between 07:35 and 21:45 UTC on Aug 31, 2026.
- Hunt egress to coder-infra.com and 199.91.220.205, purge cached modules, and upgrade to 2.37.0 / 2.36.4 / 2.35.7 / 2.34.9.
- Rotate every credential reachable from an affected provisioner, cloud keys first.
- Grep for dlp.sh / dlp-docker.sh and for the data.external.telemetry sentinel in provisioner job logs.

## Remediation

### Contain now · 0-24h

- Search firewall, proxy, DNS and VPC flow logs for outbound traffic to coder-infra.com or 199.91.220.205 across the window and after.
- Clear cached registry modules, and run the SQL query in Coder's advisory to identify and purge affected modules from your deployment cache.
- Upgrade to a patched build: 2.37.0, 2.36.4, 2.35.7 or 2.34.9.

### Investigate · assume breach · 24-72h

- Treat every credential reachable from an affected provisioner as compromised and rotate it, cloud keys first: they unlock more than any single model or app.
- Rotate in order: AWS / GCP / Azure, then Anthropic and OpenAI keys, then CI/CD and Git tokens, container registry credentials, Coder API session tokens, SSH keys and kubeconfigs.
- Grep hosts and images for dlp.sh and dlp-docker.sh, and hunt provisioner job logs for the sentinel string data.external.telemetry (Coder publishes a query for this).

### Harden strategically

- Pin and cache modules through an internal mirror so a hijacked upstream host cannot serve you code directly.
- Treat the provisioner as a secrets-bearing tier: scope its credentials per template, keep it out of coderd, and give it short-lived tokens.
- Add egress control and behavioral monitoring around agent workspaces. A hostname allowlist does not help when the malicious payload arrives from the correct hostname; the exfiltration leg is where this class of attack becomes visible.

## Timeline

- 2026-08-28 — Domain registered: coder-infra.com is registered
- 2026-08-31 07:35 UTC — Rogue IPs serve malware: Unauthorised IPs added to the registry.coder.com Cloudflare pool
- 2026-08-31 21:45 UTC — Serving stops: Roughly a 14-hour window
- 2026-09-01 — Advisory + patched builds: Coder publishes GHSA-vx42-ghc9-gw65 and patched builds

## Leaked by association

- Cloud · AWS: AWS_ACCESS_KEY_ID / _SECRET
- Cloud · GCP: GOOGLE_APPLICATION_CREDENTIALS
- Cloud · Azure: ARM_CLIENT_ID / _SECRET
- AI · Anthropic: ANTHROPIC_API_KEY
- AI · OpenAI: OPENAI_API_KEY
- CI/CD: pipeline / runner secrets
- Git / VCS: GITHUB_TOKEN / GITLAB_TOKEN
- Container registry: registry login / creds
- Coder API: CODER_* session tokens
- SSH / K8s: SSH keys / kubeconfig


This list reflects what typically lives in a Coder provisioner or template, not a measured per-deployment inventory.

## Indicators of compromise

- domain: www[.]coder-infra[.]com (registered 2026-08-28)
- ipv4: 199.91.220[.]205
- file: dlp-docker.sh
- file: dlp.sh (five variants observed)
- sha256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398 (dlp-docker.sh)
- artifact: Terraform data "external" "telemetry" block
- artifact: /cli/check request path, X-CLI-Token header
- advisory: GHSA-vx42-ghc9-gw65

## Sample output

```
# Egress hunt across the window and after
grep -R "coder-infra\|199.91.220" /var/log 2>/dev/null

# Payload hunt on hosts and images
find / -name "dlp*.sh" 2>/dev/null

# Provisioner artifact in template sources
rg -n 'data "external" "telemetry"' .
```

## Sources

- [Coder advisory GHSA-vx42-ghc9-gw65: window, IoCs, SQL, rotation, patched builds](https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65)
- [Coder Discord #announcements (Sep 1): second source](https://answeroverflow.com/m/1544144200545865728)
- [CVE-2026-46354 (GHSA-6x44-w3xg-hqqf): prior unauth PKCS#7 bypass, CVSS 9.1](https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf)
- [BleepingComputer (Sep 3): press pickup, relays the advisory](https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised/)
- [registry.coder.com: the delivery channel served maliciously](https://registry.coder.com)
- [coder/coder: "Secure environments for developers and their agents"](https://github.com/coder/coder)
- [Coder success stories: install base](https://coder.com/success-stories)

---

Published by Optimus Labs · Civilizations, the threat research team at Optimus Labs. Optimus Labs secures the enterprise agentic AI attack surface: discovery and governance of every AI agent, MCP server, and SKILL, posture management against the OWASP Top 10 for LLM Applications, and runtime behavior anomaly detection. More briefings: https://optimuslabs.io/research/briefings