Terraform module fetch/execution during Coder registry compromise window

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects the execution of Terraform commands (init, apply, plan) that interact with the 'registry.coder.com' domain, or direct network connections to the associated infrastructure. This may indicate the use of unauthorized or compromised Infrastructure-as-Code (IaC) modules or malicious supply chain activity involving Terraform configurations.