Threat actors breached Coder’s Cloudflare account on August 31, adding rogue servers that served Terraform modules laden with credential-stealing code. Engineers who pulled the tampered modules may have had credentials and access stolen. Coder removed the rogue servers, terminated sessions, and issued fresh integrity hashes, underscoring that upstream tampering can defeat even vigilant defenses.

Why it matters:

• Upstream supply-chain poisoning: Manipulating origin pools allows threat actors to silently inject backdoored infrastructure-as-code modules directly into enterprise CI/CD pipelines under a trusted domain.
• Defensive vigilance required: Organizations relying on third-party registries must enforce strict cryptographic hash verification and isolate administrative origin accounts with mandatory multi-party authentication.