A widely used npm package, art-template, has been hijacked to deliver a Coruna-style iOS Safari exploit framework via a sophisticated watering-hole supply-chain attack, with malicious payloads aimed at iOS 11.0–17.2 users through compromised browser bundles.
art-template Package Compromised
Socket’s Threat Research team reports that the original art-template maintainer, aui, transferred control of the project to an unknown actor who claimed they would take over maintenance after the project became inactive.
According to AUI, the new controller quickly began pushing versions that loaded external scripts and then deleted GitHub issues that raised concerns, a pattern consistent with a maintainer-aware compromise rather than an accidental misconfiguration.
From the site owner’s perspective, this looks like a normal frontend dependency. However, every end user’s browser silently executes attacker-controlled JavaScript with access to cookies, localStorage, forms, and potential exploit paths.
The core implant, 49554fde7424c31c.js, is a heavily obfuscated JavaScript framework designed exclusively for Safari/WebKit, explicitly targeting iOS 11.0 through 17.2 and partially macOS Safari, while hard-rejecting Chrome, Firefox, Edge, Android, and iOS 17.3+.
On load, it immediately starts beaconing the victim’s public IP, device OS version, and a campaign code to the C2 server at l1ewsu3yjkqeroy[.]xyz every 10 seconds, using ipv4.icanhazip.com as a benign-looking IP oracle to reduce detection.
According to Socket research, the framework performs five layers of anti-bot and environment checks: blocking the navigator.
webdriver automation, verifying WebRTC and WebGL support, using a MathML color-rendering trick to weed out headless browsers, probing IndexedDB or Web SQL/localStorage behavior for accurate device fingerprinting, and using timeouts to avoid hanging in sandboxes.
Only genuine Safari/WebKit environments that pass all these checks proceed to the next stages, which include WebAssembly-based memory layout probing, CPU architecture detection via Mach-O magic scanning, and version-specific offset calculations that strongly indicate preparation for WebKit JIT exploitation rather than generic phishing.
The implant then assigns one of several version-specific flags (mmrZ0r, RbKS6p, ShQCsB, KeCRDQ, JtEUci, wC3yaB) corresponding to iOS version bands, with a hard cutoff at iOS 17.3.
At this point, all payload flags are reset. Each flag maps to a distinct content-addressed remote module, fetched from utaq[.]cfww[.]shop via SHA-256-derived paths gated by a secret session key, ensuring the actual exploit code stays hidden unless the correct key is used.
For the primary target population iOS 16.6 to 17.2, which covers a large share of non-auto-updating iPhones the JtEUci path triggers, fetching a dedicated WASM loader and subsequently a final .lA() payload whose precise behavior is still under analysis.
Indicators of Compromise
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
