A module registry is a service that stores and distributes reusable software modules for tools such as Terraform. In infrastructure as code, these modules are pulled automatically when a team initializes or updates a configuration, which makes the registry part of the build and deployment trust chain.
Module registries matter because they can turn a simple download into executable infrastructure logic. If an attacker can redirect registry traffic, publish a lookalike module, or tamper with a legitimate package, the automation may run untrusted code during provisioning. That can expose cloud credentials, environment variables, or nearby configuration files. Defenders reduce this risk by pinning versions, verifying registry endpoints, monitoring DNS and proxy logs, and treating unexpected module changes as a supply chain event rather than a routine update.