Jun 27, 2024
0 new incidents, 1 with updates.
Updated
- ClosedHighPatched
polyfill.io CDN turned malicious on 100k+ sites
The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.
polyfill.io CDNClosed Jun 27, 2024
