Researchers: polyfill.io, which offers JavaScript polyfills, is being used to infect 100K+ websites with malware, after a Chinese CDN bought the domain in 2024
Scripts turn malicious, infect webpages after Chinese CDN swallows domain — The polyfill.io domain is being used to infect …
Context & Ripple Effects
This incident turns a widely embedded JavaScript utility into a distribution point for malicious code, extending a long-running web dependency risk: an earlier analysis found widespread use of JavaScript libraries with known vulnerabilities, captured in research on vulnerable JavaScript dependencies.
It also echoes a hacked plugin incident that compromised thousands of websites, but the reported domain acquisition makes third-party asset ownership and delivery infrastructure the central trust boundary.
First-order effects
- Websites that continued loading scripts from polyfill.io could serve attacker-controlled code to their visitors, putting site operators and users immediately at risk.
- Organizations relying on the service must inventory where it is embedded and replace or remove the affected external dependency to stop further exposure.
Second-order effects
- Security teams will face pressure to audit externally hosted scripts, not just application code they build and deploy themselves.
- CDN and JavaScript-service customers may reassess whether domain ownership changes, vendor control, and script delivery paths receive sufficient monitoring.
Third-order effects
- If such incidents persist, web supply-chain security will increasingly center on continuous verification of third-party runtime assets rather than one-time approval of popular libraries.
- The episode strengthens the case for treating a dependency's hosting domain and delivery operator as part of the software supply chain, though adoption will vary with organizations' ability to self-host or monitor assets.
The trend: The web is moving toward stricter governance of third-party JavaScript as attackers exploit trusted distribution channels rather than individual sites directly.