Polyfill supply chain attack hits 100K+ sites
sansec.io
The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.

Archived link

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

  • Allero@lemmy.todayEnglish
    102·
    5 months ago

    Let’s not make the splinternet a reality, pretty please.

    Chinese scaling and manufacturing, Russian IT expertise, Iranian experience of sanctions evasion and North Korean hacking and remote operations mastery are not the combo you want to bet against.

    They would absolutely build the self-sustaining economy and rival networks, but in the process it would destroy the Internet as we know it, and break communication channels that are vital for democracy and international peace, while also breaking communications between relatives and friends on the two sides.

    • T156@lemmy.worldEnglish
      2·
      5 months ago

      China is already trying quite hard with its Great Firewall. We don’t need to make their job easier for them.