Loading story…
An attacker compromised Coder’s Cloudflare infrastructure and added unauthorized servers to the backend pool for registry.coder.com, causing some Terraform module requests to receive tampered artifacts. From 07:35 to 21:45 UTC on August 31, users creating or updating Coder templates or deploying workspaces without Terraform module caching could have retrieved modules containing external data blocks that executed shell scripts.
The malicious code searched provisioner environments for cloud, AI-tooling, CI/CD, OIDC, SSH, database, and other credentials, then exfiltrated them to the lookalike domain coder-infra.com. Coder rated advisory GHSA-vx42-ghc9-gw65 Critical (CVSS v4 9.0) and released versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9; affected organizations should review logs and downloaded modules, clear cached packages, and rotate potentially exposed secrets. Coder said refresh tokens were not provided to provisioners and found no evidence that customer data it maintains was affected, although the full impact cannot be confirmed because attacker server logs are unavailable.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Rogue Cloudflare origins reportedly served tampered registry modules from 07:35 to 21:45 UTC on August 31. The report identified the rogue IP 199.91.220[.]205, poisoned templates including aider and zed, execution of dlp-docker.sh, and exfiltration to www[.]coder-infra[.]com/cli/check using the X-CLI-Token header.
An unidentified actor compromised Coder's Cloudflare infrastructure, added unauthorized servers to the registry.coder.com pool, and caused some requests to receive tampered Terraform modules. The modules executed credential-stealing shell scripts and exfiltrated collected secrets to coder-infra.com.
The lookalike domain coder-infra.com, later used for data exfiltration, was registered three days before the registry compromise.
Coder published advisory GHSA-vx42-ghc9-gw65, rated CVSS v4 9.0 Critical, describing the Cloudflare and registry compromise. It released versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, and advised affected users to investigate downloads and rotate potentially exposed secrets.
Coder reported that attackers accessed its Cloudflare infrastructure through a compromised API key, enabling them to add rogue registry origins. Coder also said refresh tokens were not provided to provisioners and that its investigation found no evidence that platform-stored customer data was compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcexakep.ru
Open sourcescworld.com
Open sourcereddit.com
Open sourceinfosec.pub
Open sourcebleepingcomputer.com
Open sourcethreats.wiz.io
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Mini Shai-Hulud** campaign compromised widely used developer packages across **npm, PyPI, and Packagist/Composer**, including SAP CAP components, `intercom-client`, `intercom/intercom-php`, and PyTorch Lightning’s `lightning` package. The malicious releases delivered an obfuscated credential stealer executed with the **Bun** runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to **TeamPCP**. Reports estimated exposure ranging from more than **1,000** to roughly **1,800 repositories**, with no `CVE`, `GHSA`, or `OSV` identifiers assigned at disclosure. Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s `cloudmtabot` account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm **OIDC trusted publishing** policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting `.vscode/tasks.json` entries with `"runOn": "folderOpen"` and `.claude/settings.json` `SessionStart` hooks, a technique compared to the earlier **PolinRider/TasksJacker** tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized `folderOpen` tasks and Claude hooks.
Jun 29, 2026
The **TeamPCP** software supply-chain campaign compromised CI/CD tooling and packages including Trivy, KICS, LiteLLM, Telnyx, CanisterWorm, and more than 66 npm packages. Malicious code deployed TeamPCP Cloud Stealer to collect GitHub, cloud-provider, SSH, and package-manager credentials; on GitHub-hosted Linux runners, it dumped `Runner.Worker` process memory to extract secrets. Stolen credentials were reportedly reused to move between victims and expand the compromise chain. The LiteLLM intrusion reportedly added Kubernetes lateral-movement features, Python `.pth` persistence, and exfiltration to attacker-created GitHub repositories. Organizations using affected build pipelines should rotate potentially exposed credentials, review CI/CD logs and runner activity for memory-dumping behavior and unauthorized repository access, and investigate package versions and build artifacts for tampering. Canary credentials placed in runner files, environment variables, and memory can provide early alerts when credential-stealing malware accesses or uses decoy secrets.
Sep 4, 2026
Researchers disclosed a large-scale automated supply chain attack dubbed **Megalodon** that pushed **5,718 malicious commits** into **5,561 GitHub repositories** in less than six hours, using forged CI/CD bot identities and benign-looking commit messages to slip in malicious GitHub Actions workflow files. The workflows requested elevated permissions and carried base64-encoded bash payloads that executed after maintainers merged the changes, harvesting CI/CD environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code and developer secrets. Investigators said the stolen data was exfiltrated over HTTP POST requests to **`216.126.225[.]129:8443`**, with two workflow variants observed, including payloads labeled **SysDiag** and **Optimize-Build**. The most visible downstream impact was a compromise of the **Tiledesk** repository, where a malicious workflow change led to the publication of poisoned **`@tiledesk/tiledesk-server`** npm versions **`2.18.6`** through **`2.18.12`**. Reporting tied the activity to a broader pattern of software supply chain abuse associated with **TeamPCP**, whose earlier incidents affected major open-source and commercial projects and prompted npm to invalidate some write-capable granular access tokens that could bypass 2FA protections. Security firms urged organizations to review repositories for unauthorized workflow changes, block the identified command-and-control infrastructure, rotate exposed secrets and keys, and inspect cloud and CI logs for signs of credential theft or cloud impersonation.
Jun 29, 2026