CODER'S REGISTRY INFRASTRUCTURE COMPROMISED TO PUSH MALICIOUS MODULES

Summary from the TLDR InfoSec newsletter

An attacker added unauthorized IPs to Coder's Cloudflare pool for registry.coder.com and served credential-stealing Terraform modules between 07:35 and 21:45 UTC on August 31, exfiltrating cloud, CI/CD, OIDC, and SSH secrets to coder-infra[.]com. Patched releases are 2.37.0, 2.36.4, 2.35.7, and 2.34.9.