art-template sold to a shell company, then shipped the Coruna iOS exploit kit

On May 19, 2026, Socket published an account of an unusual npm supply-chain attack: the malicious code in three releases of the JavaScript template engine art-template had been shipped not by an account takeover but by the package's lawful new owner, eighteen months after a quiet sale to a Malaysian shell company. The kit at the end of the chain was Coruna, a well-documented iOS exploit framework, and the buyer's paperwork had been convincing enough to survive months of due diligence by the original maintainer.

art-template is a Chinese-origin JavaScript template engine with about 26,000 weekly npm downloads. The last clean release was 4.13.2 on 2018-11-13. On 2024-11-17 the original maintainer, GitHub user aui, accepted an acquisition offer from KILLER WHAL AI SDN BHD, a Malaysian company at 35A Jalan SG3/1, Taman Sri Gombak, registration 202001036306. The pitch was cash plus continued maintenance. He ran the checks a careful maintainer would: the SSM company register, the acquiring law firm, a contract, payment. Then he transferred npm and GitHub, and aui was renamed to goofychris. Publishing rights for art-template, express-art-template, art-template-loader, and koa-art-template moved to daughtrymom, npmpacketmaintainmember7, and v4v5qc. The receiving bank account was later flagged by Chinese law enforcement and bank risk controls, and the buyer cooperated for months on paperwork until the freezes cleared, which is exactly what kept the transfer looking legitimate.

The first injection followed on 2025-03-12 in 4.13.3, published by v4v5qc, and it lived only in the browser bundle lib/template-web.js: a String.fromCharCode-obfuscated loader that fetched https://git.youzzjizz.com/git.js, which in turn loaded Baidu Analytics. The original author posted a GitHub warning that "v4.13.3 contains a virus" and reported the package to npm. npm did not act. The next day goofychris published 4.13.4 with the injection removed, explaining in an issue that "we wanted to make simple statistics," then deleted both the warning thread and the explanation. The second wave shipped on 2026-05-19 as 4.13.5 and 2026-05-20 as 4.13.6, again in lib/template-web.js and again leaving the Node entry point untouched. This loader pulled v3.jiathis.com/code/jia.js from a compromised Chinese social-sharing CDN, pinged Baidu Analytics, and gated on User-Agent for iPhone. Matching devices got a zero-pixel iframe hidden behind a closed Shadow DOM pointing at utaq.cfww.shop/gooll/gooll.html, which served a 50 KB fingerprinting loader that beaconed every ten seconds and content-addressed each follow-on module against a session key.

The final stage was Coruna itself: fourteen remote modules, about 606 KB, chaining twenty-three Safari and WebKit vulnerabilities. The kit stopped at iOS 17.3, matching the CVE-2024-23222 patch for a JavaScriptCore type-confusion bug, dispatched between ARM64 and ARM64_32 builds, and ran a WebAssembly proof-of-work to confirm it was talking to a real JIT rather than a sandbox. The terminal payload was a 31 KB native shellcode dropper for the PLASMAGRID cryptocurrency-wallet implant; anything outside Safari on iOS 13.0 through 17.2.1 got only the Baidu tracker. Socket attributed the deployment to UNC6691 on Coruna fingerprints previously documented by Google TAG, and SafeDep reached the same attribution independently. Both advised pinning art-template and its siblings to 4.13.2 and auditing caches and bundles for the four attacker domains. The harder problem sits upstream of the package manager: a clean legal acquisition leaves none of the forensic seams an account takeover does. The original author has filed npm tickets 3286247 and 4401568, and says the accounts remain active and the malicious versions still cannot be unpublished.