When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack

A fourteen-hour window

• On Monday, August 31, between 07:35 and 21:45 UTC, Coder's module registry served malicious code to a subset of its users. Coder disclosed it the next day in a GitHub Security Advisory — GHSA-vx42-ghc9-gw65, rated critical at CVSS 9.0.
• An unidentified attacker gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool behind registry.coder.com. Those rogue servers hosted a tampered copy of the registry. For roughly fourteen hours, anyone who created or updated a template, ran a template dry-run, or deployed a workspace with module caching disabled pulled modules from a malicious registry — served from the real registry.coder.com domain.
• The tampered modules carried shell scripts — dlp.sh and dlp-docker.sh, invoked through a Terraform external data block — that scanned for credentials in environment variables, configuration files, and shell history, then exfiltrated them to a lookalike domain, coder-infra.com, registered three days before the attack. The poisoned modules were injected into specific popular templates, including the AI coding tools aider and zed, alongside rstudio-server and windows-rdp.
• One detail decides everything about this incident: the malicious download came from the real domain. Version pinning wouldn't have helped, because there was no bad release to pin away from. Domain allowlisting wouldn't have flagged the pull, because registry.coder.com is the domain you're supposed to trust. Only the exfiltration used the lookalike.

Why this lands on your AI stack

• Coder isn't a niche tool. It's the platform enterprises use to run cloud development environments and, increasingly, autonomous AI coding agents on infrastructure they control. Coder's own customer stories include the U.S. Department of Defense, a U.S. defense-intelligence organization running more than 2,500 developers, Palantir, Dropbox, and a fintech onboarding 15,000 engineers.
• Those workspaces and their Terraform provisioners hold exactly the secrets worth stealing: cloud provider keys for AWS, GCP, and Azure; AI-tooling keys for Anthropic and OpenAI; CI/CD tokens; and Git and SSH credentials. When an agent runs inside a Coder workspace, those keys are what it runs on. Harvest the provisioner and you've harvested the keys to the estate.
• What actually leaked depends on which path you hit. Authoring or updating a template exposes the provisioner's own environment — your cloud, AI-tooling, and CI/CD keys. Building a workspace additionally hands the provisioner the user's OIDC token, their SSH key, and any external-auth tokens for GitHub, GitLab, or Bitbucket (single-use, but enough). And if you run the provisioner inside coderd rather than as a separate service, the advisory notes your Coder database password and configuration likely leaked too.
• Most organizations touched by this were never targeted. If your deployment pulled a module during the window, the payload scraped whatever it could reach. You leaked by association.

The part your tooling never saw

• There is no CVE for this incident. It isn't in the National Vulnerability Database. It hasn't propagated to OSV, and when we went looking, no third-party threat-intelligence vendor had written it up. The only public record is Coder's GitHub advisory and a message in Coder's community Discord.
• Compare that to an ordinary vulnerability. Weeks earlier, Coder disclosed CVE-2026-46354 — a critical (CVSS 9.1) signature bypass in its Azure instance-identity flow that let an unauthenticated attacker forge a workspace-agent session token and pull Git SSH keys and OAuth tokens for GitHub, GitLab, and Bitbucket. That one got a CVE, landed in NVD and OSV, and was analyzed by Orca, Snyk, and Tenable within days. The machinery worked.
• The registry hijack skipped the machinery entirely, because it wasn't a flaw in Coder's code. It was a compromise of Coder's delivery infrastructure. Infrastructure incidents don't get CVEs, don't flow into the feeds your scanners subscribe to, and don't appear anywhere in your dependency graph. Your software-composition-analysis tool has nothing to match against. Your AIBOM lists the models, datasets, and libraries your agents use; it doesn't list your development platform's CDN, registry, or DNS — which is exactly where this one lived.
• That is the pattern behind agentic AI supply chains, and it should reframe how security teams think about coverage: the risks that reach your agents most directly are often the ones no feed will ever tell you about.

What to do if you run Coder

• Exposure here is scoped by activity, not by version. You may be affected if a Coder deployment pulled a registry module between 07:35 and 21:45 UTC on August 31.
• Contain now. Review firewall, proxy, DNS, and VPC flow logs for outbound traffic to coder-infra.com or 199.91.220.205. Clear cached registry modules, and run the SQL query Coder provides to identify and purge affected modules from your deployment's cache. Upgrade to a patched build: 2.37.0, 2.36.4, 2.35.7, or 2.34.9.
• Assume breach. Treat every credential reachable from an affected provisioner as compromised, and rotate it — cloud keys, AI-tooling keys, CI/CD and Git tokens, anything that lived in environment variables, configuration files, or shell history on those hosts.
• Hunt. Grep hosts and images for dlp.sh and dlp-docker.sh. The dlp-docker.sh SHA-256 is 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398; watch for the Terraform data "external" "telemetry" block that invokes it. Coder also provides a query to search your provisioner job logs for the sentinel string data.external.telemetry.
• Coder reports no indication that customer data it maintains was impacted. The risk is credential exfiltration from affected deployments — so verify your own logs and cache state rather than waiting for a definitive victim list.

The lesson for agentic security

• You can't patch your way out of an attack that ships no patch, and you can't scan for an indicator that never reaches your feed. The controls that catch this class of incident don't look at CVEs or package hashes. They look at behavior — an agent's workspace suddenly reading environment variables it never touched, then reaching out to a domain it has never called.
• That behavioral view is the problem we work on at Optimus Labs. Our endpoint sensor watches what AI agents, MCPs, and skills actually do — their intent and their runtime actions — instead of waiting for a vulnerability feed to catch up. Credential harvesting inside a workspace and exfiltration to an unfamiliar domain are precisely the behaviors an intent-aware control surfaces, CVE or not.
• The Coder registry hijack will earn a footnote in someone's quarterly report eventually. The agents in your environment are running today. If you want to see how endpoint-based agent security would surface an incident like this in your own stack, book a demo.

Leaked by association

Rotate cloud credentials first: the AWS, GCP and Azure keys that provision workspaces are the master keys to your estate and unlock far more than any single app or model.

Also at risk: user OIDC tokens, single-use external-auth tokens for GitHub, GitLab or Bitbucket, the coderd database password and config, Terraform state and internal service tokens. The list reflects what typically lives in a Coder provisioner or template, not a measured per-deployment inventory.

Indicators

Sample output

# Egress hunt since the window opened
grep -R "coder-infra\|199.91.220" /var/log 2>/dev/null

# Payload hunt on hosts and images
find / -name "dlp*.sh" 2>/dev/null

# Provisioner artifact
rg -n 'data "external" "telemetry"' .

Sources