The @cdnshell/loader npm package masquerades as a CDN static-asset distribution library but contains 19 pre-compiled Mach-O binaries targeting iOS versions 13 to 19. These binaries reference private iOS entitlements and WebKit GPU-process IPC symbols consistent with a WebKit renderer-to-kernel exploit chain. The package includes an obfuscated JavaScript loader that dynamically fetches and executes remote code, selecting payload variants based on the visitor's user agent. The malicious behavior activates only when the loader is embedded in a webpage served to iOS/macOS users, enabling targeted exploitation. There are no npm lifecycle hooks or main entry points, so the package does not execute on installation or require, making detection harder. This combination of obfuscation, multi-version exploit payloads, and dynamic remote code execution is inconsistent with legitimate static asset distribution libraries.