Archived link

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

  • dactylotheca@suppo.fi
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    1
    ·
    4 months ago

    You’re still trusting that the 1st party javascript won’t be vulnerable to supply chain attacks, though

    • valaramech@fedia.io
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      4 months ago

      In my experience, first-party JavaScript is more likely to be updated so rarely that bugs and exploits are more likely than supply chain attacks. If I heard about NPM getting attacked as often as I hear about CDNs getting attacked, I’d be more concerned.

      • vxx@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        2
        ·
        4 months ago

        Funny that they want you to allow all java scripts but then criticise first party scripts for being unsave.

        I bet [insert random autocrat here] would approve of that message.