#PolyfillIOAttack

iam-py-test :unverified:iampytest1@infosec.exchange
2024-07-09

On July 5th, PolyfillIO switched to polyfill[.]top
This domain is currently unblocked by uBlock Origin and all major blocklists.
Tweet: x[.]com/Polyfill_Global/status
Thread with more information and also making fun of Windows users.

#PolyfillIO #PolyfillIOAttack

A Tweet from @Polyfill_Global, posted at 3:11 on July 5th 2024. The Tweet reads "use new domain polyfill.top"
iam-py-test :unverified:iampytest1@infosec.exchange
2024-06-27
iam-py-test :unverified:iampytest1@infosec.exchange
2024-06-26

GitHub has placed a warning on the PolyfillIO repository (github.com/polyfillpolyfill/po), and has denied access for non-logged in users. The other two repositories owned by that account are unblocked. Dismissing the warning appears to be permanent for an account.

#PolyfillIo #polyfillIoAttack #GitHubSecurity

A warning reading "This repository contains malicious content that may cause technical harms. We have decided to preserve this content for security research purposes. Please exercise CAUTION when clicking links, downloading releases, or otherwise interacting with this repository."
There are two buttons; "Discover other projects on GitHub" and "View repository".
Offscreen, there are options to block the user polyfillpolyfill and view GitHub's guidelines.
iam-py-test :unverified:iampytest1@infosec.exchange
2024-06-26

PolyfillIO maintainer denies they are serving malicious JavaScript

Someone has maliciously defamed us. We have no supply chain risks because all content is statically cached. Any involvement of third parties could introduce potential risks to your website, but no one would do this as it would be jeopardize our own reputation.

github.com/polyfillpolyfill/po

#polyfillIo #polyfillIoAttack

🔷 leckseleckse@animexx.de
2024-06-26

@KarlE Warum das eine schlechte Idee ist, demonstriert gerade Polyfill.io.

#polyfillio #polyfill #polyfillioattack #polyfail

2024-06-26

If you're still using polyfill.io you probably want to replace/remove it IMMEDIATELY. The domain has been sold and the new owners are injecting #malware (1).

If you absolutely have to use externally hosted #JavaScript and #CSS, it's a good idea to secure it with #SubresourceIntegrity (2). It's supported by most old browsers you're probably polyfilling for.

(1) polykill.io/
(2) developer.mozilla.org/en-US/do

#polyfillio #polyfillioattack #supplychainattack

2024-06-26

Just added some more resources like old CNAME records, a link to archive org as well as a link to the GitHub thread discussing the payload.

Interesting part here: I haven't come across a second source for the payload yet. it always circles back to the GitHub issue from 5 days ago.

#polyfillio #polyfillioattack

iam-py-test :unverified:iampytest1@infosec.exchange
2024-06-25

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst