GCVE-110-OSM-2025-317

Ecosystem package now under control of the same compromised maintainer (daughtrymom) responsible for the art-template account takeover. While malicious versions may not yet be published, the package should be treated as suspect given the maintainer-side compromise of the parent art-template package and 3 sibling ecosystem packages. Maintainer compromise indicator. Original maintainer aui was replaced by daughtrymom across art-template, express-art-template, art-template-loader, and koa-art-template. The same compromised maintainer published trojanized art-template versions 4.13.3-4.13.6 delivering an iOS browser exploit kit. Pin to a clean version published prior to the maintainer change and audit installs.