Polyfill supply chain attack hits 100K+ sites
sansec.io
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.

Archived link

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

  • dactylotheca@suppo.fiEnglish
    81·
    6 months ago

    You’re still trusting that the 1st party javascript won’t be vulnerable to supply chain attacks, though

    • valaramech@fedia.io
      31·
      6 months ago

      In my experience, first-party JavaScript is more likely to be updated so rarely that bugs and exploits are more likely than supply chain attacks. If I heard about NPM getting attacked as often as I hear about CDNs getting attacked, I’d be more concerned.

      • vxx@lemmy.worldEnglish
        12·
        6 months ago

        Funny that they want you to allow all java scripts but then criticise first party scripts for being unsave.

        I bet [insert random autocrat here] would approve of that message.