Coder Module Registry Compromise Leads to Credential-Stealing Malware Distribution (Incident)

Coder's module registry was compromised after attackers gained access to Coder's Cloudflare infrastructure and added attacker-controlled IPs to serve modified modules. Malicious artifacts (dlp.sh, dlp-docker.sh) were distributed that harvest credentials (cloud API keys, CI/CD tokens, environment variables, config files, terminal history) and exfiltrated them to a lookalike domain (coder-infra.com); users interacting with affected templates or with module caching disabled were at risk. Coder reports no current indication of direct compromise of customer data and has released a forced template cache-clearing update.