The @cdnshell/loader npm package is a malicious library that delivers a multi-stage exploit targeting iOS/macOS devices via WebKit vulnerabilities. It ships with 19 pre-compiled Mach-O binaries for various iOS versions, including variants for a64e/PAC architectures, referencing private entitlements and IPC symbols indicative of a renderer-to-kernel exploit chain. The JavaScript entrypoint is heavily obfuscated and dynamically fetches and executes remote modules based on the visitor's platform, enabling remote code execution. The package does not execute during npm install or require, activating only when embedded in web content served to targeted devices. This behavior and payload set strongly indicate a sophisticated supply chain attack vector designed to compromise iOS/macOS users through malicious web content.

Devices running iOS versions 13 through 19 and macOS that visit webpages embedding this loader may be targeted by a WebKit exploit chain capable of executing code with elevated privileges. The exploit leverages private entitlements and kernel-level primitives, potentially allowing attackers to escalate privileges and execute arbitrary code on the device. The malicious code is not triggered by npm install or require, reducing detection during development but posing a significant risk to end users exposed via web content. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Since the package does not execute on npm install or require, avoid embedding or serving the @cdnshell/loader package in any web content, especially to iOS/macOS users. Monitor and audit dependencies for this package and remove any usage immediately. Check vendor advisories or npm security notices for updates or removal actions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.