The art-template npm package versions 4.13.3, 4.13.5, 4.13.6, and 4.13.7 were compromised due to an npm account takeover. The attacker modified the browser bundle file (lib/template-web.js) to load malicious remote JavaScript. This malicious payload is the Coruna iOS exploit kit, which targets Safari browsers on iPhone and iPad devices and installs the PLASMAGRID cryptocurrency-wallet stealer. The compromise affects only client-side usage of the browser bundle; server-side Node.js usage is not directly impacted. The last clean version before the compromise is 4.13.2. Due to the nature of the compromise, any system running these versions should be treated as fully compromised.

The malicious code enables remote attacker-controlled JavaScript execution in the browser context, leading to exploitation of Safari on iOS devices and installation of a cryptocurrency wallet stealer. This results in potential full compromise of affected client systems. Server-side Node.js environments using art-template are not directly affected. The compromise can lead to theft of sensitive credentials and keys stored on the infected systems.

Remove all affected versions (=4.13.3, =4.13.5, =4.13.6, =4.13.7) of art-template immediately. Rotate all secrets and keys stored on any compromised systems from a secure, unaffected environment. Consider the affected systems fully compromised and perform a thorough incident response and remediation. Use version 4.13.2 or earlier, which is the last known clean release. There is no official patch or fixed version beyond 4.13.2 mentioned. Monitor vendor advisories for updates. Note that removing the package alone may not remove all malicious artifacts due to the full compromise.