# When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack
# Optimus Labs · Civilizations — https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack
# Published: 2026-09-01 | Severity: critical
# Affected: Coder, Cloudflare, AWS, GCP, Azure, Anthropic, OpenAI, GitHub, GitLab, Bitbucket
#
# Machine-readable siblings:
#   STIX 2.1: https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.stix.json
#   MISP event: https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.misp.json
#   Markdown: https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.md

## domain
www.coder-infra.com

## ipv4
199.91.220.205

## file
dlp-docker.sh
dlp.sh

## sha256
7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398

## ghsa
GHSA-vx42-ghc9-gw65

## narrative-indicators
# Exfil domain: www[.]coder-infra[.]com (registered 2026-08-28)
# Rogue registry IP: 199.91.220[.]205
# Payloads: dlp-docker.sh plus five dlp.sh variants
# dlp-docker.sh SHA-256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398
# Provisioner artifact: Terraform data "external" "telemetry" block
# Other observed artifacts: /cli/check path, X-CLI-Token header
# Window: Aug 31, 2026, 07:35-21:45 UTC. Templates: aider, zed, rstudio-server, windows-rdp
# Advisory: GHSA-vx42-ghc9-gw65 (CVSS 9.0, no CVE). Patched: 2.37.0 / 2.36.4 / 2.35.7 / 2.34.9