# art-template npm Supply Chain Backdoor — Coruna Respawned iOS Safari Watering-Hole Exploit Kit (v4.13.3/4.13.5/4.13.6, CVE-2024-23222)

> Unknown actors acquired the widely-used art-template JavaScript templating library (~27K weekly npm downloads) via maintainer handover from original author 'aui' and published three backdoored releases (4.13.3, 4.13.5, 4.13.6) that inject a remote script loader into the browser bundle. Any web app bundling those versions becomes a watering hole silently delivering a Coruna-derivative iOS Safari exploit framework to Safari/iOS 11.0–17.2 visitors — the precise patch boundary for CVE-2024-23222 (WebKit type confusion). Socket.dev linked the implant to the Coruna kit documented in TL-2026-0174 and published the research as 'Coruna Respawned'.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0568
- **ID:** TL-2026-0568
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-23222

## Description

On 2026-05-22 Socket.dev published 'Coruna Respawned', detailing a supply chain compromise of the npm package art-template (a server- and browser-side JavaScript templating library originally authored by 'aui'). Sometime in early 2025 the original maintainer transferred publishing rights to an unknown actor under the pretense of continuing maintenance. The new controller — operating under npm accounts 'daughtrymom' and 'npmpacketmaintainmember7' — almost immediately weaponized the package, deleted issue reports flagging the suspicious behavior, and published a sequence of backdoored releases culminating in versions 4.13.3 (2025-03-12), 4.13.5 (2026-05-19), and 4.13.6 (2026-05-20). 4.13.3 used basic encoding to hide a loader pointing to an external domain; 4.13.5 and 4.13.6 abandoned obfuscation and appended a plaintext script loader directly to lib/template-web.js (the browser bundle), so every web application bundling those versions calls out to attacker infrastructure on first load.

The injected loader fetches a JavaScript implant from v3.jiathis[.]com that functions as a watering hole exploit-delivery framework. The implant fingerprints every site visitor and activates only on Safari running iOS 11.0 through 17.2, exiting silently on Chrome, Firefox, Edge, Android, and iOS 17.3 or higher. The cutoff aligns precisely with the patch release for CVE-2024-23222, a WebKit type confusion vulnerability (CWE-843, CVSS 8.8) that Apple fixed in iOS 17.3 / Safari 17.3 on 2024-01-22 and that was the keystone exploit of the original Coruna kit (TL-2026-0174). This precision strongly indicates browser-level RCE rather than conventional phishing or social engineering.

Once a matching device is detected, the implant beacons to a C2 every ten seconds carrying the victim's public IP address, iOS version string, and a campaign tracking code. Five anti-bot layers run in sequence — including a MathML rendering test (forces a layout path uncommon in headless browsers) and a WebAssembly proof-of-work challenge — to confirm the target is a real person on real hardware before any payload is fetched. Only after all checks pass does the framework request the next-stage exploit module from utaq[.]cfww[.]shop. Payload selection is keyed to the victim's iOS version: five distinct iOS version bands each map to a different remote exploit module (5 bands × 1 module = 5 distinct payload paths), with the targeting range and band scheme cloning the original Coruna kit's structure for the patched WebKit type confusion bug.

Remote modules are concealed via a content-addressed fetch scheme: the implant computes hash(secret_session_key, module_id) to derive each module URL, so passive scanners that lack the session key cannot enumerate or retrieve payloads. XOR obfuscation of fetched modules matches byte-for-byte the obfuscation documented by published YARA rules for the original Coruna kit, and the campaign-code beacon format mirrors the proliferation-era Coruna infrastructure tracked under TL-2026-0174 (attributed by Google TAG / iVerify to a chain originating with L3Harris Trenchant and onward sold to Operation Zero, UNC6353, and UNC6691).

While the operator of this specific watering-hole campaign has not been publicly attributed, the implant is either a direct reuse or a near-identical derivative of the Coruna delivery stack — meaning whoever stood up this campaign acquired or obtained access to the Coruna source/infrastructure. The use of an npm supply chain ingress (rather than targeted spearphishing or operator-managed lure domains) marks a meaningful shift in the delivery model and dramatically increases the exposure surface: any of the tens of thousands of weekly art-template downloaders who shipped 4.13.3/4.13.5/4.13.6 to production became unwitting watering holes for Apple-device visitors. With CVE-2024-23222 long patched at iOS 17.3, the active victim pool is iOS users who have not (or cannot) update — including iPadOS users still on iOS 15.x/16.x branches.

Mitigations: audit dependency trees for art-template 4.13.3 through 4.13.6 (note: 4.13.4 was published 2025-03-14 between the two malicious clusters and should be treated as suspicious until independently audited); lock dependencies and review the actual lib/template-web.js bundle output for unexpected external script loaders; block outbound traffic to v3.jiathis[.]com, utaq.cfww[.]shop, and l1ewsu3yjkqeroy[.]xyz at the perimeter and from CSP frame-src/script-src; force-update all managed iOS devices to ≥17.3; treat npm accounts 'daughtrymom' and 'npmpacketmaintainmember7' as untrusted across all packages they publish.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1195 Supply Chain Compromise
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1564 Hide Artifacts
- T1553 Subvert Trust Controls
- T1082 System Information Discovery
- T1518 Software Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Hackers Backdoor Popular art-template npm Package to Launch Watering-Hole Attacks](https://cybersecuritynews.com/hackers-backdoor-popular-art-template-npm-package/)
- [Coruna Respawned — Socket.dev research (referenced by CSN)](https://socket.dev/)
- [CVE-2024-23222 — NVD record (WebKit type confusion, fixed in iOS 17.3)](https://nvd.nist.gov/vuln/detail/CVE-2024-23222)
- [Apple Security Update — About the security content of iOS 17.3 and iPadOS 17.3](https://support.apple.com/en-us/HT214059)
- [Threadlinqs TL-2026-0174 — Coruna iOS Exploit Kit (parent kit attribution)](https://intel.threadlinqs.com/threat/TL-2026-0174)
- [art-template on npm — registry metadata showing maintainer change](https://www.npmjs.com/package/art-template)
- [art-template GitHub repository (original maintainer aui)](https://github.com/aui/art-template)
- [CISA Software Bill of Materials guidance (relevant to npm supply chain defense)](https://www.cisa.gov/sbom)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0568