Polyfill supply chain attack hits 100K+ sites (sansec.io)

Article summary

A Chinese company has bought the popular Polyfill JS project and injected malware into over 100,000 sites that use the cdn.polyfill.io domain. The malware redirects mobile users to a sports betting site using a fake Google analytics domain. The original polyfill author recommends not using Polyfill at all, as it is no longer needed by modern browsers. Fastly and Cloudflare have put up trustworthy alternatives for those who still need it.

Main themes

• Supply chain attack
• Malware injection
• Polyfill JS project
• CDN security
• Web development
• Security risks

What commenters say

• Using a CDN for dependencies can be a security risk due to the potential for supply chain attacks, and hosting dependencies oneself is a safer alternative.
• The use of subresource integrity can mitigate some of these risks, but it may not be effective in cases where the CDN serves dynamic content.
• The polyfill.io service's dynamic generation of polyfills based on user agent headers makes it incompatible with subresource integrity, increasing the security risk.
• Some commenters argue that paying for dependencies can reduce the incentive for maintainers to sell out and compromise security, while others suggest that hosting dependencies oneself is the best solution.
• The incident highlights the importance of monitoring and controlling the code that users load, and the need for developers to be aware of the potential security risks of using third-party services.
• The fact that the polyfill.io domain was sold to a Chinese company without the knowledge of the project's maintainers raises concerns about the security and transparency of open-source projects.
• Some argue that the benefits of using a CDN, such as improved performance, are no longer relevant due to advances in web technology, and that hosting dependencies oneself is now a better option.
• The incident has led to a discussion about the need for more secure and transparent ways of managing dependencies and ensuring the integrity of open-source projects.