art-template npm Supply Chain Backdoor — Coruna Respawned iOS Safari Watering-Hole Exploit Kit (v4.13.3/4.13.5/4.13.6, CVE-2024-23222)
art-template npm Supply Chain Backdoor (TL-2026-0568), also tracked as Coruna Respawned, is a critical-severity supply-chain compromise scored CVSS 8.8, first published 2026-05-22. It has no confirmed attribution, affects aui (original) / daughtrymom + npmpacketmaintainmember7 (npm hijacker), references 1 CVE (CVE-2024-23222), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0568
- Threat ID
- TL-2026-0568
- Also known as
- Coruna Respawned, art-template backdoor, art-template watering hole
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-22
- Last reviewed
- 2026-05-22
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- technology, media, e-commerce, finance, government, education, all-web-publishers-bundling-art-template
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in art-template npm Supply Chain Backdoor
Malware and tooling: Coruna iOS exploit delivery framework (Respawned variant)
Unknown actors acquired the widely-used art-template JavaScript templating library (~27K weekly npm downloads) via maintainer handover from original author 'aui' and published three backdoored releases (4.13.3, 4.13.5, 4.13.6) that inject a remote script loader into the browser bundle. Any web app bundling those versions becomes a watering hole silently delivering a Coruna-derivative iOS Safari exploit framework to Safari/iOS 11.0–17.2 visitors — the precise patch boundary for CVE-2024-23222 (WebKit type confusion). Socket.dev linked the implant to the Coruna kit documented in TL-2026-0174 and published the research as 'Coruna Respawned'.
How art-template npm Supply Chain Backdoor works
On 2026-05-22 Socket.dev published 'Coruna Respawned', detailing a supply chain compromise of the npm package art-template (a server- and browser-side JavaScript templating library originally authored by 'aui'). Sometime in early 2025 the original maintainer transferred publishing rights to an unknown actor under the pretense of continuing maintenance. The new controller — operating under npm accounts 'daughtrymom' and 'npmpacketmaintainmember7' — almost immediately weaponized the package, deleted issue reports flagging the suspicious behavior, and published a sequence of backdoored releases culminating in versions 4.13.3 (2025-03-12), 4.13.5 (2026-05-19), and 4.13.6 (2026-05-20). 4.13.3 used basic encoding to hide a loader pointing to an external domain; 4.13.5 and 4.13.6 abandoned obfuscation and appended a plaintext script loader directly to lib/template-web.js (the browser bundle), so every web application bundling those versions calls out to attacker infrastructure on first load.
The injected loader fetches a JavaScript implant from v3.jiathis[.]com that functions as a watering hole exploit-delivery framework. The implant fingerprints every site visitor and activates only on Safari running iOS 11.0 through 17.2, exiting silently on Chrome, Firefox, Edge, Android, and iOS 17.3 or higher. The cutoff aligns precisely with the patch release for CVE-2024-23222, a WebKit type confusion vulnerability (CWE-843, CVSS 8.8) that Apple fixed in iOS 17.3 / Safari 17.3 on 2024-01-22 and that was the keystone exploit of the original Coruna kit (TL-2026-0174). This precision strongly indicates browser-level RCE rather than conventional phishing or social engineering.
Once a matching device is detected, the implant beacons to a C2 every ten seconds carrying the victim's public IP address, iOS version string, and a campaign tracking code. Five anti-bot layers run in sequence — including a MathML rendering test (forces a layout path uncommon in headless browsers) and a WebAssembly proof-of-work challenge — to confirm the target is a real person on real hardware before any payload is fetched. Only after all checks pass does the framework request the next-stage exploit module from utaq[.]cfww[.]shop. Payload selection is keyed to the victim's iOS version: five distinct iOS version bands each map to a different remote exploit module (5 bands × 1 module = 5 distinct payload paths), with the targeting range and band scheme cloning the original Coruna kit's structure for the patched WebKit type confusion bug.
Remote modules are concealed via a content-addressed fetch scheme: the implant computes hash(secret_session_key, module_id) to derive each module URL, so passive scanners that lack the session key cannot enumerate or retrieve payloads. XOR obfuscation of fetched modules matches byte-for-byte the obfuscation documented by published YARA rules for the original Coruna kit, and the campaign-code beacon format mirrors the proliferation-era Coruna infrastructure tracked under TL-2026-0174 (attributed by Google TAG / iVerify to a chain originating with L3Harris Trenchant and onward sold to Operation Zero, UNC6353, and UNC6691).
While the operator of this specific watering-hole campaign has not been publicly attributed, the implant is either a direct reuse or a near-identical derivative of the Coruna delivery stack — meaning whoever stood up this campaign acquired or obtained access to the Coruna source/infrastructure. The use of an npm supply chain ingress (rather than targeted spearphishing or operator-managed lure domains) marks a meaningful shift in the delivery model and dramatically increases the exposure surface: any of the tens of thousands of weekly art-template downloaders who shipped 4.13.3/4.13.5/4.13.6 to production became unwitting watering holes for Apple-device visitors. With CVE-2024-23222 long patched at iOS 17.3, the active victim pool is iOS users who have not (or cannot) update — including iPadOS users still on iOS 15.x/16.x branches.
Mitigations: audit dependency trees for art-template 4.13.3 through 4.13.6 (note: 4.13.4 was published 2025-03-14 between the two malicious clusters and should be treated as suspicious until independently audited); lock dependencies and review the actual lib/template-web.js bundle output for unexpected external script loaders; block outbound traffic to v3.jiathis[.]com, utaq.cfww[.]shop, and l1ewsu3yjkqeroy[.]xyz at the perimeter and from CSP frame-src/script-src; force-update all managed iOS devices to ≥17.3; treat npm accounts 'daughtrymom' and 'npmpacketmaintainmember7' as untrusted across all packages they publish.
MITRE ATT&CK techniques used in TL-2026-0568
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
initial-access
defense-impairment
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities
Affected products and versions in art-template npm Supply Chain Backdoor
- aui (original) / daughtrymom + npmpacketmaintainmember7 (npm hijacker) — art-template (npm package)
Vulnerable versions: 4.13.3; 4.13.5; 4.13.6
Fixed in: 4.13.2 (last known clean release, 2018-11-13) - Apple — Safari / WebKit on iOS, iPadOS, macOS, tvOS, visionOS
Vulnerable versions: iOS 11.0–17.2; iPadOS 11.0–17.2; Safari ≤17.2; macOS Monterey ≤12.7.2; macOS Ventura ≤13.6.3; macOS Sonoma ≤14.2; tvOS ≤17.2; visionOS 1.0.0–1.0.1
Fixed in: iOS 17.3; iPadOS 17.3; iOS 16.7.5; iPadOS 16.7.5; iOS 15.8.7; iPadOS 15.8.7; Safari 17.3; macOS Monterey 12.7.3; macOS Ventura 13.6.4; macOS Sonoma 14.3
Remediation for art-template npm Supply Chain Backdoor
Patches
- Apple Safari 17.3, iOS/iPadOS 17.3, iOS/iPadOS 16.7.5, iOS/iPadOS 15.8.7, macOS Sonoma 14.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3, tvOS 17.3, visionOS 1.0.2 (CVE-2024-23222 type-confusion fix, shipped 2024-01-22)
- Downgrade art-template to 4.13.2 (last release by original maintainer 'aui' on 2018-11-13); await audited replacement release before re-upgrading
Immediate actions
- Audit all package-lock.json / yarn.lock / pnpm-lock.yaml for art-template ranges resolving to 4.13.3, 4.13.4, 4.13.5, or 4.13.6 and pin to 4.13.2 or earlier pending vendor guidance
- Block DNS and HTTPS egress to v3.jiathis[.]com, utaq.cfww[.]shop, and l1ewsu3yjkqeroy[.]xyz at perimeter, EDR, and DNS resolvers
- Inspect built browser bundles (lib/template-web.js and any minified output that imported art-template) for an unexpected loadScript() call or external <script src> injection at the end of the file
- Force-update managed iOS and iPadOS fleet to ≥17.3 / 16.7.5 / 15.8.7 (the patched releases for CVE-2024-23222)
- Add Content-Security-Policy script-src and frame-src restrictions on production web properties that previously bundled art-template to prevent unknown third-party script execution
Workarounds
- Self-host art-template lib/template-web.js from a known-clean 4.13.2 snapshot and override the npm resolution via package.json overrides/resolutions
- Strip art-template from the client bundle entirely and migrate to Mustache, Handlebars, or native template literals on the browser side
- Front-end gate all third-party JS via Subresource Integrity (SRI) hashes computed against 4.13.2 — bundle build will fail on tampered output
Longer-term hardening
- Deploy continuous SCA scanning (Socket, Snyk, GitHub Advanced Security, Dependabot) with alerts on maintainer ownership changes — not just version bumps
- Subscribe to npm OSV / GitHub Advisory Database feeds and block install-time on unverified maintainer transitions
- Treat browser-bundle outputs as build artifacts that must pass byte-level diff review for any external network call introduced by a transitive dependency
- Maintain an iOS patch SLA (≤72h) for managed devices and pair with WebKit-targeted MDM detections (Crash Reporter, WebContent process anomalies)
- Add YARA rules for Coruna XOR-obfuscated stage two on web proxy / TLS-inspecting egress points
CVEs associated with art-template npm Supply Chain Backdoor
Weaknesses (CWE) in art-template npm Supply Chain Backdoor
CWE-843, CWE-506, CWE-829, CWE-1357, CWE-494
Timeline of art-template npm Supply Chain Backdoor
- Original maintainer 'aui' publishes art-template 4.13.2 to npm — the last known clean release before the maintainer handover.
- Apple ships iOS/iPadOS 17.3 and Safari 17.3, patching CVE-2024-23222 (WebKit type confusion) — the keystone exploit used by the original Coruna kit and the precise upper bound the Respawned implant targets.
- art-template 4.13.3 published to npm by new maintainer accounts 'daughtrymom' / 'npmpacketmaintainmember7' — contains an encoded loader pointing to an external domain. First backdoored release.
- art-template 4.13.4 published — content not yet independently audited; published between two malicious clusters by the same hijacker maintainers and should be treated as suspicious.
- art-template 4.13.5 published — drops the obfuscation and injects a plaintext script loader directly into lib/template-web.js (the browser bundle).
- art-template 4.13.6 published — same plaintext script loader pattern, last malicious release observed at disclosure.
- Threadlinqs Intelligence opens TL-2026-0568 to track the Coruna Respawned supply chain campaign and correlate IOCs with the parent kit (TL-2026-0174) and BeaconBeagle C2 datasets.
- Socket.dev publishes 'Coruna Respawned' research linking the implant to the original Coruna iOS exploit kit (Threadlinqs TL-2026-0174); Cyber Security News publishes coordinated reporting.
- As of 2026-05-29, this remains ACTIVE: Socket's 2026-05-22 disclosure is corroborated by multiple outlets, and the npm registry still lists the hijacker accounts daughtrymom/npmpacketmaintainmember7 as maintainers with backdoored 4.13.3 live and tagged latest=4.13.4 (only 4.13.5/4.13.6 pulled). CVE-2024-23222 is patched/in CISA KEV but unpatched iOS 11.0-17.2 devices stay exploitable; no C2 takedown or maintainer restoration confirmed.
Sources cited for art-template npm Supply Chain Backdoor
- Hackers Backdoor Popular art-template npm Package to Launch Watering-Hole Attacks
- Coruna Respawned — Socket.dev research (referenced by CSN)
- CVE-2024-23222 — NVD record (WebKit type confusion, fixed in iOS 17.3)
- Apple Security Update — About the security content of iOS 17.3 and iPadOS 17.3
- Threadlinqs TL-2026-0174 — Coruna iOS Exploit Kit (parent kit attribution)
- art-template on npm — registry metadata showing maintainer change
- art-template GitHub repository (original maintainer aui)
- CISA Software Bill of Materials guidance (relevant to npm supply chain defense)
Threats related to art-template npm Supply Chain Backdoor
Detection coverage for TL-2026-0568
As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0568 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.