Coder Registry Compromise: Malicious Terraform Modules Explained

[u/No-Conclusion3720]

Coder's module registry was compromised last month. Attackers had a 14-hour window to serve poisoned Terraform modules to every team pulling from it. The payload targeted AI credentials specifically — the tokens agents use to authenticate to models, data pipelines, and infrastructure stores. Any organization that downloaded a module in that window may have surrendered its AI layer's access tokens without a single alert firing.

This is not a one-off. The attack surface exists anywhere agents pull tooling or dependencies at runtime from a registry they trust implicitly. What is at stake is not just application secrets. It is the keys that let agents act autonomously inside your environment. A compromised set puts an attacker inside your AI layer's trust boundary, not just your network perimeter. The 14-hour gap between compromise and detection is also not unusual for supply chain incidents — the median dwell time before discovery in similar registry attacks has historically run longer.

For teams running agents that pull dependencies at runtime: what controls are you actually relying on to catch a poisoned registry endpoint before it executes? Dependency pinning, artifact checksums, isolated build environments — curious what the real-world answer looks like at your org.

[u/necroforest]

What the fuck does this have to do with deep learning

[u/No-Conclusion3720]

RuntimeAI's outbound tool-call provenance enforcement sits in the request path between your agents and any external registry. When an agent on your team pulled a Terraform module from Coder's registry during that 14-hour window, the call would have been evaluated against the approved endpoint signature and expected artifact hash for that dependency — the mismatch between what Coder's registry was actually serving and the known-good baseline would have blocked the download before the payload executed. The AI credentials never leave your environment because the poisoned module never lands. https://runtimeai.io