Critical art-template npm Package Flaw Lets Attackers Backdoor Websites

Key Takeaways

• A critical supply chain attack compromised the widely used art-template npm package.
• Malicious versions 4.13.3, 4.13.5, and 4.13.6 injected exploit code into web applications, targeting Apple iOS users running Safari on versions 11.0 through 17.2.
• The attack leveraged an exploit delivery framework reminiscent of the “Coruna” exploit kit, likely exploiting the WebKit vulnerability CVE-2024-23222.
• Developers should immediately audit their dependencies for affected versions and upgrade to a secure version.

Sophisticated Supply Chain Attack Targets art-template npm Package

The popular JavaScript templating library, art-template, has been at the center of a sophisticated supply chain attack that led to the compromise of its npm package. This incident, uncovered by researchers at Socket.dev, involved the silent injection of malicious code into end-users’ browsers, effectively transforming everyday web applications into watering holes designed to target Apple device owners globally.

The compromise began when the original maintainer, known as “aui,” transferred control of the art-template npm package to an unknown individual under the guise of continued maintenance. According to the original author, the new package controller almost immediately started weaponizing the library. Reports highlighting suspicious activities were reportedly deleted, while the attacker continued to push malicious versions, attempting to evade detection.

Coruna Exploit Kit Resurfaces

In a report shared with Cyber Security News (CSN) titled “Coruna Respawned,” Socket.dev researchers confirmed their identification of the campaign. Their analysis revealed a strong resemblance between the implant within the backdoored package and the delivery patterns of the previously documented iOS exploit framework known as the Coruna exploit kit, suggesting either direct reuse or a highly similar derivative.

The backdoored versions of art-template exhibited an escalating pattern of malicious code injection. Version 4.13.3 employed encoding to obscure a loader that pointed to a suspicious external domain. Subsequent versions, 4.13.5 and 4.13.6, abandoned obfuscation entirely, directly injecting a plaintext script loader into the package’s browser bundle file. Consequently, any web application incorporating these compromised versions would silently load and execute the exploit kit within every visitor’s browser.

The broad adoption of the art-template package across numerous JavaScript projects worldwide means the potential exposure is substantial. Developers who inadvertently bundled the compromised versions effectively became unknowing conduits for a targeted mobile attack against their own user base, with no overt indicators of compromise.

How the Watering Hole Attack Unfolded

At the core of this attack is a JavaScript implant designed to function as a watering hole exploit delivery framework. Once injected via the compromised npm package, it discreetly profiles each website visitor. The implant specifically activates only on Safari browsers running on iOS versions 11.0 through 17.2, and it is programmed to silently exit on other browsers like Chrome, Firefox, Edge, Android devices, and iOS versions 17.3 or higher.

Upon detecting a compatible device, the implant initiates communication with a command-and-control (C2) server every ten seconds, transmitting the victim’s public IP address, iOS version string, and a unique campaign tracking code. To confirm the target is a genuine user on actual hardware, it employs five layers of anti-bot checks, including MathML rendering tests and a WebAssembly proof-of-work challenge. Only after successfully passing all these checks does the framework proceed to fetch and execute the final server-gated payload.

The selection of the final payload is precisely tailored to the victim’s iOS version, with five distinct version bands each corresponding to a different remote exploit module. Researchers noted that the hard cutoff at iOS 17.3 aligns perfectly with the patch boundary for CVE-2024-23222, a WebKit vulnerability that Apple addressed in that specific release. This precision strongly indicates browser-level exploitation rather than conventional phishing tactics.

npm Supply Chain as the Entry Point

The entire delivery chain for the attack originated from the corrupted npm package and led directly to the victim’s device. Specifically, versions 4.13.5 and 4.13.6 appended a script loader to the browser-side bundle, which then initiated a call to an external domain. This domain subsequently redirected visitors to a watering hole page hosting the exploit framework. From the moment any website utilizing these compromised versions was visited, the attack silently activated in the background.

The implant employs a content-addressed module system to obscure its payloads from external scrutiny. Remote modules are fetched via URLs derived by hashing a secret session key with a module identifier, rendering them invisible to scanners that lack knowledge of this key. This architectural design mirrors infrastructure patterns documented for the original Coruna kit, including identical XOR obfuscation confirmed by published YARA rules.

What You Should Do

• Audit Dependencies: Immediately audit your project’s dependency tree for any installations of art-template versions 4.13.3, 4.13.5, or 4.13.6.
• Upgrade or Remove: If affected versions are found, upgrade to a secure version of art-template or remove the dependency if it’s no longer needed.
• Review Browser Bundles: Examine your application’s browser bundle outputs for any unexpected script loaders or suspicious external calls.
• Monitor Network Requests: Implement monitoring for outbound network requests originating from your JavaScript runtimes to detect anomalous connections.
• Conduct Security Review: Any application deployed with affected versions should undergo an immediate and thorough security review.
• Implement Dependency Locking: Utilize dependency locking mechanisms (e.g., package-lock.json, yarn.lock) to prevent unexpected package updates.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.