art-template npm supply chain compromise and Coruna exploit delivery chain analysis

Vulnerability Overview Vulnerability Name: art-template npm Coruna Browser Exploit Compromise Publication Date: 2026-05-24 Reading Time: 12 minutes Source: 1 Tags: #supply-chain, #npm, #browser, #javascript, #exploit-delivery Impact Scope Affected Versions: art-template 4.13.5 and 4.13.6 Vulnerability Type: npm package tampering, injection of remote browser-side JavaScript, redirecting users to a Coruna-like iOS Safari exploit delivery chain Severity: High Impact: Attackers can execute malicious operations through the injected JavaScript code, including redirecting users, collecting browser and end-user data, etc. Remediation Confirm Affected Status: Verify if the affected art-template versions are in use Remove Affected Versions: Remove the affected art-template versions Rebuild Assets: Rebuild assets, invalidate CDN object caches, and retain network telemetry data Clean Caches: Clean deployed old CDN object caches to ensure affected assets do not appear in current traffic Key Facts Timeline 2026-05-20: Socket published public research on the art-template package tampering and Coruna-like exploit delivery chain 2026-05-24: Local branch created a standalone article instead of a weekly summary Technical Details Initial Access: Package maintainer rights change, malicious version published Package or Artifact Tampering: Malicious code injected into Execution Trigger: Application or website loads the affected art-template browser code Payload Behavior: Loads remote JavaScript, fingerprints the client, filters automated environments, checks Safari/iOS conditions, fetches additional modules Exfiltration / C2: Observed network indicators include , , etc. Propagation: Package-to-package propagation confirmed, impact scope expanded through downstream builds and caches Obfuscation or Evasion: Focuses on browser targeting and analysis evasion Affected Assets and Blast Radius Exploit Code Downstream Abuse Audit

Goal Reached Thanks to every supporter — we hit 100%!

art-template npm supply chain compromise and Coruna exploit delivery chain analysis