Popular npm Package “art-template” Backdoored in Watering

Gbhackers •Mayura Kathir • May 22, 2026

Hackers compromised the popular art-template npm package to inject a stealthy backdoor that redirected users’ browsers to a malicious watering‑hole site delivering a Coruna‑class iOS exploit framework. The campaign turned a widely used JavaScript templating library into a delivery vehicle for advanced Safari exploits targeting iPhones running iOS 11 through 17.2. The art-template package is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack on art-template npm Package Delivers iOS Exploit The art-template npm package, a popular JavaScript templating library, was compromised to deliver a sophisticated iOS exploit targeting Safari users. Discovered on May 20, 2026, the attack involved a watering-hole method that redirected users to a command-and-control server. The malicious payload specifically targets iOS versions 11.0 through 17.2, rejecting newer versions to avoid detection. The exploit framework is believed to be a variant of the established Coruna exploit kit, containing multiple exploit chains. This incident highlights the risks associated with supply chain vulnerabilities in widely used open-source libraries. Users of the compromised package are urged to take immediate action to mitigate potential risks. The attack has been linked to broader trends in supply chain attacks affecting software development environments. 3 sources 71

Extracted Entities

Popular npm Package “art-template” Backdoored in Watering

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)