A serious supply chain attack was recently discovered involving the Polyfill.io service, used by thousands of websites to ensure compatibility with older browsers. The attack affected over 100,000 sites, raising significant concerns about online security and trust in third-party libraries.

The Polyfill.io Breach

Polyfill.io provides “polyfills,” pieces of JavaScript code that implement modern functionalities in older browsers. This service was compromised after the domain management was transferred to the Chinese company Funnull in February 2024. Shortly thereafter, the code distributed through Polyfill.io began to contain malicious scripts, primarily targeting mobile devices, which redirected users to sports betting sites and adult content.

The Response from the Tech Community

The attack raised immediate concerns among security experts and web infrastructure providers. Cloudflare and Fastly quickly implemented secure versions of the Polyfill service to mitigate the risks. Additionally, Google began notifying its advertisers about the potential risks related to sites that loaded code from Polyfill.io, blocking ads on these compromised sites.

Recommendations for Webmasters

Security experts strongly recommend immediately removing any references to Polyfill.io from websites. In addition, it is advised to adopt security measures such as:

• Implementing a Content Security Policy (CSP): to restrict the sources from which scripts can be loaded.

• Using Subresource Integrity (SRI): to verify that the resources downloaded have not been tampered with.

• Regularly Monitoring Dependencies: performing periodic security audits to detect any abnormal behavior.

The Polyfill.io incident is a clear example of the risks associated with using third-party libraries and highlights the importance of adopting robust security practices to protect web infrastructure. Companies must remain vigilant, regularly update their dependencies, and follow best practices for security.