Coder Registry Hacked via Cloudflare to Deliver Credential-Stealing Terraform Modules

·1 views

Attackers gained unauthorized access to Coder's Cloudflare configuration and inserted a malicious server into the module registry's delivery pool, causing some users to receive tampered Terraform modules. The malicious modules were designed to search for credentials in the execution environment and exfiltrate them to an attacker-controlled domain, coder-infra[.]com. Compromise could occur during routine operations such as template imports, updates, dry runs, or workspace builds, and cached modules extend the window of potential exposure beyond the initial incident period. Coder has published a security advisory, GHSA-vx42-ghc9-gw65, including SQL queries to help administrators detect signs of malicious module execution in provisioner job logs. Affected organizations are advised to audit fetched modules within the target timeframe, clear caches, and rotate any secrets accessible from impacted provisioner environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Adjust animation speed via playback FPS, not by redrawing sprite sheets

Game developers often unnecessarily modify sprite sheets when animation speed feels off, but the fix usually lies in adjusting playback FPS rather than adding or changing frames. The same eight-frame sprite sheet can produce a one-second loop at 8 fps, a two-thirds-second loop at 12 fps, or a half-second loop at 16 fps — no pixel changes required. Developers should distinguish between source FPS, frame count, and playback FPS, as these are independent variables that together determine how an animation feels in-game. To avoid rounding drift when calculating frame timing, each boundary should be derived from its index rather than by repeatedly adding a fixed hold duration. Both Godot and Phaser offer engine-level controls for animation speed, and tools like the FrameSprite timing calculator can help export per-frame timing data for more precise adjustments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How HarmonyOS NEXT Ditches Android Roots With a Custom Compiler and Declarative UI

Huawei's HarmonyOS NEXT, often called 'Pure HarmonyOS,' is a microkernel-based operating system that fully drops compatibility with the Android Open Source Project. Unlike Android's JVM-based runtime, it uses the ArkCompiler, an Ahead-of-Time compiler that converts ArkTS — a strict TypeScript subset — into native C++ at build time, eliminating runtime type inference and garbage collection overhead. The UI framework, ArkUI, uses a declarative model where the @State decorator is compiled into native getter/setter code that automatically flags components as 'dirty' when data changes, triggering targeted redraws without a full tree scan. Developers familiar with Android must adapt to new concepts: UIAbilities replace Activities, ArkUI replaces ViewGroups, and ArkTS replaces Java or Kotlin. The architecture is designed for high performance across distributed devices, representing a distinct third path in mobile OS design beyond Android and iOS.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic's Claude Agents Formally Prove Fermat's Last Theorem in 11 Days

Anthropic announced on September 4 that a team of Claude AI agents produced the first complete, computer-verified proof of Fermat's Last Theorem, a problem unsolved for over 350 years. The agents worked largely autonomously for 11 days, generating 13 million lines of Lean code and proving more than 29,500 theorems. Early attempts failed not due to model limitations but because agents lost track of the project's shared state and stopped coordinating effectively. The breakthrough came when a shared directed acyclic graph was introduced to serve as collective memory for the agent team. Mathematician Kevin Buzzard reviewed the proof, and a verification tool confirmed it matched the standard Lean statement of the theorem, using only three accepted axioms with no omitted steps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Missing Features Forced a Self-Hosting Lexer to Grow from 129 to 355 Lines

A developer building 'lm', a small statically-typed low-level language with four compiler backends, attempted to port its JavaScript lexer into lm itself as a self-hosting milestone. The port revealed six core language gaps — including no pointer-to-local, no constants, no character literals, no string type, no labelled loop breaks, and no hex notation — that together caused the lm lexer to be nearly three times longer than its JavaScript equivalent. The absence of a centralised advance() function forced inline duplication across 14 call sites, which introduced a latent correctness bug in column counting that only goes undetected due to incidental newline resets. The developer intentionally chose the lexer as the first porting target because, at 129 lines, it was small enough to abandon if the language proved inadequate. The exercise served as a planned diagnostic, exposing fundamental expressiveness limits before the project scaled further.

0 comments Read more at DEV Community