From cyberplace.social/@GossiTheDog…
All credit to @GossiTheDog

Without CDN/Archived: web.archive.org/web/sansec.io/…

Polyfill[.]io is now serving malware.
This is why you should not rely embed third party scripts on your website.
Only load JavaScript from domains you own - and preferably, only load JavaScript you/your organization wrote.
Third party JavaScript is and will always be a threat to privacy and security.

#polyfillio

Polyfill supply chain attack hits 100K+ sites

The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.

^Sansec

Kevin Beaumont

2024-06-25 20:20:48

Can’t find my thread to update it, but after a Chinese company acquired Polyfill.io last year (embedded in over 100k websites), it has started serving malware to users of said websites - prepare to be surprised.

sansec.io/research/polyfill-su…

#threatintel

Polyfill supply chain attack hits 100K+ sites

The new Chinese owner of the popular Polyfill JS project injects malware into more than 100 thousand sites.

^Sansec