ClosedPatched

polyfill.io CDN turned malicious on 100k+ sites

polyfill.io CDN

The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.

Why this severity: Supply-chain attack via third-party JavaScript CDN

Started: Jun 25, 2024
Closed: Jun 27, 2024

Follow this incident

Updated Jun 27, 2024

Affected

Any site loading scripts from cdn.polyfill.io

Fixed in

Remove polyfill.io references or switch to the Cloudflare/Fastly mirrors

Timeline2

Jun 27, 2024
Cloudflare rewrites cdn.polyfill.io to its mirror; Namecheap puts the domain on hold
Source
Jun 25, 2024
Sansec reports the polyfill.io supply-chain attack hitting 100k+ sites
Source

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified