Coder Module Registry Supply-Chain Attack — GHSA-vx42-ghc9-gw65

On 2026-08-31, between 07:35 and 21:45 UTC, an attacker who had compromised a Cloudflare API key added unauthorized origin server(s) — including malicious IP 199.91.220.205 — to the Cloudflare origin pool backing registry.coder.com, Coder's official Terraform module registry. For that window, a subset of registry traffic was silently routed to attacker infrastructure instead of Coder's legitimate servers. The rogue origin served tampered Terraform modules that invoked a malicious script (dlp.sh / dlp-docker.sh) via a Terraform data "external" block during provisioning.

The script harvested cloud credentials (AWS/GCP/Azure), AI-tooling API keys, CI/CD tokens, configuration-file secrets, terminal history, user OIDC tokens, SSH keys, external-auth tokens, and — when the provisioner ran inside coderd — the Coder database password, exfiltrating everything to the lookalike domain coder-infra.com (registered 2026-08-28) via http://www.coder-infra.com/cli/check with header X-CLI-Token: your-secret-token. Coder identified and fully remediated the incident the same day and shipped patched releases 2.37.0, 2.36.4, 2.35.7, and 2.34.9. GitHub Advisory GHSA-vx42-ghc9-gw65 rates the issue Critical, CVSS v4 9.0/10.

This is a supply-chain / CI-CD / developer-endpoint event, not classic malware: the highest-value detections are (1) exact-IOC network/DNS matches to the exfil domain and IP, (2) execution of the named DLP scripts, (3) anomalous shell children of Terraform/Coder provisioning processes, and (4) credential-file access clustering immediately after a provisioning run. Falcon endpoint telemetry covers items 1–4 well; the Cloudflare control-plane compromise itself and Coder's internal database exposure sit outside endpoint visibility and are called out as explicit coverage gaps in §15.

Defender priority: Patch every Coder deployment (2.37.0/2.36.4/2.35.7/2.34.9), block egress to coder-infra.com and 199.91.220.205, run the §7 native SQL sweep to identify affected templates/workspaces, and rotate every credential class the provisioner could have touched — these steps close the loop even for stores that were exposed before this pack existed.

All five mandated sources were fetched live on 2026-09-08 and saved verbatim to Coder-Registry-SupplyChain-Hunt-sources/ before any fact in this pack was written. Every atomic IOC shipped in this pack is corroborated by at least two independently-authored sources. All fetched content was reviewed for injected/adversarial instructions directed at an AI agent — none were found — and analyzed strictly as data.

Cross-reference notes: Domain coder-infra.com and IP 199.91.220.205 are each corroborated by three-plus independent sources; the X-CLI-Token header and data.external.telemetry construct are corroborated by three sources. No source suggested a different value for any atomic IOC, so no substitution risk applies.

Safety note: all five fetches returned ordinary editorial/vendor content. No page contained text directed at "the AI agent," no authorization claims, and no embedded commands — nothing was excluded on injection grounds.

Hunt hypotheses (ordered by fidelity)

Attack chain

These checks run directly against a Coder deployment's own database/logs, reproduced verbatim from GitHub Advisory GHSA-vx42-ghc9-gw65 (source snapshot 02-github-advisory.txt). They cover the coderd/DB surface that Falcon endpoint telemetry cannot see (§5 gap). Detection/hunt SQL only — no destructive statement is included here; the purge statement lives in the §13 Playbook B runbook.

All templates that used a module fetched during the incident window

SELECT
   t.name  AS template,
   tv.name AS template_version,
   tv.id   AS template_version_id,
   f.id    AS module_file_id,
   f.created_at AS module_cached_at,
   tv.created_at AS version_created_at
FROM files f
        JOIN template_version_terraform_values tvtv
             ON tvtv.cached_module_files = f.id
        JOIN template_versions tv
             ON tv.id = tvtv.template_version_id
        JOIN templates t
             ON t.id = tv.template_id
WHERE f.created_by = '00000000-0000-0000-0000-000000000000'
 AND f.mimetype = 'application/x-tar'
 AND f.created_at >= '2026-08-31 07:35:00+00'
 AND f.created_at < '2026-08-31 21:45:00+00'
ORDER BY t.name, tv.created_at;

All workspaces that used a module fetched during the incident window

SELECT
   w.name AS workspace,
   u.username AS owner,
   wlb.transition,
   wlb.job_status,
   wlb.created_at
FROM workspace_latest_builds wlb
        JOIN workspaces w ON w.id = wlb.workspace_id
        JOIN users u ON u.id = w.owner_id
WHERE wlb.template_version_id IN (
   SELECT tvtv.template_version_id
   FROM files f
            JOIN template_version_terraform_values tvtv
                 ON tvtv.cached_module_files = f.id
   WHERE f.created_by = '00000000-0000-0000-0000-000000000000'
     AND f.mimetype = 'application/x-tar'
     AND f.created_at >= '2026-08-31 07:35:00+00'
     AND f.created_at < '2026-08-31 21:45:00+00'
)
ORDER BY w.name;

Provisioner job logs containing the sentinel string

-- name: SearchLogsForKeyPhrase
-- Search any provisioner job logs for the sentinel string, this will be a slow query
SELECT DISTINCT
	pj.type                                 AS job_type,
	pj.id                                   AS job_id,
	wb.id                                   AS workspace_build_id,
	w.id                                    AS workspace_id,
	COALESCE(tv_import.id, tv_build.id)     AS template_version_id,
	t.id                                    AS template_id,
	t.name                                  AS template,
	COALESCE(tv_import.name, tv_build.name) AS template_version,
	w.name                                  AS workspace,
	u.username                              AS owner_or_initiator,
	pj.started_at,
	pj.job_status,
	w.deleted                               AS workspace_deleted
FROM provisioner_job_logs pjl
JOIN provisioner_jobs pj
	ON pj.id = pjl.job_id
LEFT JOIN template_versions tv_import
	ON tv_import.job_id = pj.id
LEFT JOIN workspace_builds wb
	ON wb.job_id = pj.id
LEFT JOIN template_versions tv_build
	ON tv_build.id = wb.template_version_id
LEFT JOIN workspaces w
	ON w.id = wb.workspace_id
LEFT JOIN templates t
	ON t.id = COALESCE(tv_import.template_id, tv_build.template_id, w.template_id)
LEFT JOIN users u
	ON u.id = COALESCE(w.owner_id, pj.initiator_id)
WHERE pjl.output LIKE '%data.external.telemetry%'
ORDER BY pj.started_at;

A hit on data.external.telemetry inside provisioner_job_logs, or a non-empty row set from either SELECT above, indicates this deployment pulled a tampered module during the incident window — treat as a compromise indicator requiring the §14 containment runbook, not just a tuning note.

Custom IOAs fire in real time on the same behaviors Q1–Q7 hunt for historically. Start every rule in Detect mode; promote to Block only after a measured FP rate below 5% on a canary sensor group for 14+ days, per the standing prevention-promotion policy.

Grouped, one-click blocks for import or reference. Every atomic value here traces to a saved source snapshot in Coder-Registry-SupplyChain-Hunt-sources/.

type,value,action,severity,expiration,description,tags
domain,coder-infra.com,detect,critical,2027-03-08,Coder registry supply-chain lookalike exfil domain,campaign:CoderRegistrySupplyChain
domain,www.coder-infra.com,detect,critical,2027-03-08,Coder registry supply-chain lookalike exfil domain (www subdomain),campaign:CoderRegistrySupplyChain
ipv4,199.91.220.205,detect,critical,2027-03-08,Unauthorized Cloudflare origin IP / exfil destination,campaign:CoderRegistrySupplyChain
sha256,7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398,prevent,critical,2027-03-08,dlp-docker.sh DLP payload script,campaign:CoderRegistrySupplyChain
sha256,a7f4fa5f7e33b2a6f6488cf28444584caa449144d246b083de919162f5514247,prevent,critical,2027-03-08,dlp.sh DLP payload script (common variant),campaign:CoderRegistrySupplyChain
sha256,414d01f6072fbf05bef513e277f4c2b504a413c8e2aa5bae133a5cbc0cda9dc1,prevent,critical,2027-03-08,dlp.sh DLP payload script (aider variant),campaign:CoderRegistrySupplyChain
sha256,a64ce3038f2a501c9735abf6a1f9f04cbddbad53371cd68bec0f7510365c8ffa,prevent,critical,2027-03-08,dlp.sh DLP payload script (rstudio-server variant),campaign:CoderRegistrySupplyChain
sha256,ebbe0d2ed8cfaf9e19edb38ce44d6b407f9771b5c0813a7add27c05f66e89596,prevent,critical,2027-03-08,dlp.sh DLP payload script (windows-rdp variant),campaign:CoderRegistrySupplyChain
sha256,7ef6b8c3c976fb60b3fa22e9e294ba548d9b532e060c1323a0124a3a7a647f13,prevent,critical,2027-03-08,dlp.sh DLP payload script (zed variant),campaign:CoderRegistrySupplyChain

# DLP payload script filenames
dlp.sh
dlp-docker.sh

# Terraform external-data-source construct (exploitation trigger)
data.external.telemetry

# Exfil callback path + required header
http://www.coder-infra.com/cli/check
X-CLI-Token: your-secret-token

# Incident window (UTC)
2026-08-31 07:35 - 21:45

Advisory:           GHSA-vx42-ghc9-gw65
CVSS v4:            9.0/10 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/
                    VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Root cause:         Compromised Cloudflare API key -> unauthorized
                    origin added to registry.coder.com origin pool
Payload:            dlp.sh / dlp-docker.sh (Terraform data "external"
                    block)
Lookalike domain:   coder-infra.com (registered 2026-08-28)
Patched versions:   2.37.0, 2.36.4, 2.35.7, 2.34.9

# 1. Confirm Coder deployment version is patched
coder version
# expect >= 2.37.0 / 2.36.4 / 2.35.7 / 2.34.9 (per branch)

# 2. Run the affected-template/workspace SELECT queries (Section 7)
#    against the Coder Postgres DB for the incident window
#    2026-08-31 07:35:00+00 to 2026-08-31 21:45:00+00

# 3. Confirm credential rotation completed
#    - Cloud API keys (AWS/GCP/Azure)
#    - CI/CD tokens, AI-tooling API keys
#    - SSH keys, user OIDC/external-auth tokens
#    - Coder DB password (if provisioner ran inside coderd)
#    - Cloudflare API key/token

# 4. Confirm egress block is active
dig coder-infra.com

Primary Mitigations: M1051 (Update Software), M1026 (Privileged Account Management), M1041 (Encrypt Sensitive Information), M1047 (Audit), M1037 (Filter Network Traffic), M1038 (Execution Prevention), M1013 (Application Developer Guidance). Platforms in scope: the Coder control plane and Terraform provisioning hosts, the Cloudflare account fronting registry.coder.com, and the cloud IAM (AWS/GCP/Azure) surface reachable from a provisioner — this threat does not touch Windows/AD or an on-prem network appliance, so no controls are included for those surfaces.

Step 1 — Emergency Egress Block for coder-infra.com / 199.91.220.205

Prerequisites: Firewall/DNS-sinkhole or proxy admin access; identify the enforcement point (perimeter firewall, internal DNS resolver, or web proxy). Reboot required: No.

# DNS sinkhole (BIND-style RPZ zone entry)
coder-infra.com CNAME .
*.coder-infra.com CNAME .

# Linux host-level stopgap (iptables) -- use only on hosts without a perimeter firewall path
iptables -A OUTPUT -d 199.91.220.205 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -m string --string "coder-infra.com" --algo bm -j DROP

# Generic perimeter firewall object (pseudo-config, adapt to vendor CLI)
object domain coder-infra-block
  fqdn coder-infra.com
  fqdn www.coder-infra.com
object network coder-infra-ip-block
  host 199.91.220.205
deny ip any object coder-infra-ip-block log

Verify:

dig coder-infra.com
# Expect NXDOMAIN or sinkhole IP, never the real attacker-controlled answer
# Confirm firewall hit-counter increments on the deny rule

Rollback: Remove the RPZ entries, delete the iptables rules (iptables -D OUTPUT -d 199.91.220.205 -j DROP, and the matching string-match rule), and remove the firewall deny object once the indicator is confirmed retired (recommend keeping the block indefinitely — this domain has no legitimate use).

Step 2 — Purge Cached Malicious Modules & Upgrade Coder

Prerequisites: Database access to the Coder deployment's Postgres instance; a maintenance window; a recent DB backup/snapshot. Reboot required: Coder service restart required after upgrade (not a full host reboot).

-- 1) Identify affected rows first (see Section 7 SELECT queries) and review the output.
-- 2) Purge confirmed-affected cached module files:
BEGIN;

CREATE TEMP TABLE identified_module_files ON COMMIT DROP AS
SELECT DISTINCT f.id
FROM files f
        JOIN template_version_terraform_values tvtv
             ON tvtv.cached_module_files = f.id
WHERE f.created_by = '00000000-0000-0000-0000-000000000000'
 AND f.mimetype = 'application/x-tar'
 AND f.created_at >= '2026-08-31 07:35:00+00'
 AND f.created_at < '2026-08-31 21:45:00+00';

UPDATE template_version_terraform_values
SET cached_module_files = NULL
WHERE cached_module_files IN (SELECT id FROM identified_module_files);

DELETE FROM files
   USING identified_module_files c
WHERE files.id = c.id;

COMMIT;

# 3) Upgrade Coder to a patched release
coder server --version   # confirm current version first
# then follow your deployment's normal upgrade procedure (Helm/Docker/binary) to 2.37.0 / 2.36.4 / 2.35.7 / 2.34.9

Verify:

-- Re-run the Section 7 "all templates" SELECT -- zero rows expected post-purge
coder version   # confirm >= patched release for your branch

Rollback: The DELETE is destructive by design (removing malicious cached artifacts) — restore from the pre-change DB snapshot if the wrong rows were identified. The Coder version upgrade can be rolled back by redeploying the prior container image/binary if the new release causes unexpected regressions; re-apply the module purge afterward since it is independent of version.

Step 3 — Scope Cloudflare API Access

Prerequisites: Cloudflare account Super Administrator access; inventory of current automation that uses the Global API Key. Reboot required: No.

# 1) Create a scoped API Token (Cloudflare dashboard: My Profile -> API Tokens -> Create Token)
#    Permissions: Zone.DNS:Edit, Zone.Load Balancing:Edit  (only the zones/services automation actually needs)
#    Do NOT grant Account-level "Edit" broadly.

# 2) Update automation (example: Terraform Cloudflare provider) to use the scoped token
provider "cloudflare" {
  api_token = var.cloudflare_scoped_token   # replace api_key/email auth
}

# 3) Revoke the old Global API Key once all automation is migrated
#    Dashboard: My Profile -> API Tokens -> Global API Key -> Roll/Revoke

# 4) Enable audit log alerting for origin pool / load balancer changes
#    Dashboard: Manage Account -> Audit Log -> configure webhook/alert for "Load Balancer Pool" and "Load Balancer" events

Verify:

# Cloudflare dashboard -> My Profile -> API Tokens: confirm no active Global API Key
# Audit Log shows the new alerting rule enabled for origin-pool/load-balancer/DNS changes

Rollback: Retain the old Global API Key in a disabled state (do not delete outright) for 7 days in case an unmigrated automation breaks; re-enable temporarily only if a documented emergency requires it, then re-revoke.

Step 4 — Pin Terraform Provider/Module Checksums

Prerequisites: Terraform CLI ≥ 0.14 (lock-file support); write access to the repository containing Terraform configs. Reboot required: No.

# 1) Generate/refresh the dependency lock file with checksums for all required platforms
terraform providers lock \
  -platform=linux_amd64 -platform=darwin_amd64 -platform=windows_amd64

# 2) Commit .terraform.lock.hcl to version control
git add .terraform.lock.hcl
git commit -m "Pin Terraform provider checksums post-GHSA-vx42-ghc9-gw65"

# 3) Enforce verification in CI -- fail the pipeline if the lock file changes unexpectedly
terraform init -lockfile=readonly

# 4) (Optional, strategic) point module sources at an internal registry mirror instead of the public registry
#    ~/.terraformrc
provider_installation {
  network_mirror {
    url = "https://terraform-mirror.internal.example.com/"
  }
}

Verify:

git diff .terraform.lock.hcl
# Expect no unexpected hash changes on the next `terraform init -lockfile=readonly`

Rollback: none required — pinning checksums and enforcing -lockfile=readonly only rejects unexpected provider/module changes; it does not alter running infrastructure. To temporarily lift enforcement (e.g., an urgent legitimate provider bump), drop the -lockfile=readonly flag for that single CI run.

Deploying via your RMM

The snippets above are raw shell/SQL/config. To wrap them for fleet deployment (admin check, error handling, custom-field writeback for compliance tracking), hand them to your RMM deployment tooling and ask for a deployable package.

Any template, template version, or workspace that pulled a module during 2026-08-31 07:35–21:45 UTC is in scope for this runbook even if it currently shows no active indicators — re-open this pack if new IOCs or successor infrastructure surface.

Coverage Summary: 6 of 8 identified techniques have at least partial detection coverage via CQL/IOA/IOC; 1 remains a full GAP (T1528) and 2 (T1552.001/.004) are partial due to high false-positive rates without clustering/tuning.

Priority Gaps: The Cloudflare API-key compromise and origin-pool pivot (attack-chain steps 1–2) sit entirely inside Coder's/Cloudflare's own infrastructure and are invisible to victim-org Falcon telemetry — see §5. Downstream reuse of stolen cloud/CI-CD credentials (attack-chain step 7, and T1528 token theft specifically) is not directly observable via EDR after the fact and must be handled via a dedicated cloud-IAM/CloudTrail hunt plus the blanket credential-rotation requirement in §12/§14.

Validation gates: see §11 for the field-name-validation, tenant fire-test, and native/cloud-layer gaps each query or SQL hunt must pass before being relied on operationally or promoted to Prevent/Block.

Generated 2026-09-08 by HuntPack. All fetched source text was reviewed for injected/adversarial instructions before use; none were found. This pack is defensive-only: detection logic and hardening guidance, no offensive or exploit code. No victim/environment identifiers are included.