0

Polyfill.io is malicious: https://dev.to/snyk/polyfill-supply-chain-attack-embeds-malware-in-javascript-cdn-assets-55d6

https://www.sonatype.com/blog/polyfill.io-supply-chain-attack-hits-100000-websites-all-you-need-to-know

However, I noticed that the domain polyfill.io is now offline. Also: https://news.ycombinator.com/item?id=40805827

Is it safe to say that the security issue is now fixed and now we only need to worry about websites that have errors or don't work in certain browsers? Is the supply-chain attack still possible?

Improve this question
2
  • 2
    No, it's not safe. You now have websites linking JS from an unknown source. What prevents anybody from registering polyfill.io again? Sure, the registrar may not allow that for now, but for how long? Also, fixing the JS errors and fixing the security boils down to the same action.
    – Margaret Bloom
    Commented Jun 27 at 10:41
  • @MargaretBloom Good points. Would you still say its an action that needs to be done ASAP or can be done in the next 7 days? You know before I crash the current development...
    – telion
    Commented Jun 27 at 13:59

1 Answer 1

Reset to default
1

The problem with polyfill.io is that they broke the trust we can have in them.

As it currently stands I would advise against using any scripts hosted by polyfill.io and use cdnjs or alike.

I would also highly recommend using SRI which would protect your clients from the malicious attack as happend through poly fill.io… it would mean the website would break due to missing resources (but better a broken site than to exploit your customers / clients / users)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .