Massive Polyfill Supply Chain Attack Impacts 380,000 Sites

In one of the most widespread supply chain attacks in recent memory, the popular cdn.polyfill.io service has been compromised. The domain, which historically provided web developers with polyfills to support older browsers, was acquired by a Chinese company. Shortly after, the scripts were modified to inject malicious code, dynamically redirecting visitors to sports betting and adult websites.

Security researchers have estimated that over 380,000 websites embed the compromised polyfill script. The malicious code is highly evasive, activating only under specific conditions—such as when the user is on a mobile device and not operating within a web analytics environment. This targeted execution allowed the compromise to remain undetected for an extended period.

The Risk of Third-Party Dependencies

This incident exposes the profound fragility of modern web development ecosystems that rely heavily on third-party Content Delivery Networks (CDNs). By implicitly trusting external scripts, developers inadvertently grant immense power to the owners of those domains. The polyfill attack is a stark reminder that a trusted dependency can turn into an active threat overnight.

Remediation and Alternatives

Major providers like Cloudflare and Fastly have rapidly intervened, offering secure, drop-in replacements for the compromised polyfill service. They are automatically replacing the malicious links for their customers. Developers must urgently audit their codebases to remove any references to the original cdn.polyfill.io domain and transition to verified, secure alternatives.