Remove Polyfill.io code from your website immediately • The Register
Remove Polyfill.io code from your website immediately • The Register
Scripts turn malicious, infect webpages after Chinese CDN swallows domain
In a similar vein, Heinz once used a temporary domain for a promotion accessible by scanning a QR code on their bottles. The promotion ran its course, and they let the domain name expire.
Problem is these bottles were available on restaurant tables for much longer. Didn't take long before scanning the Heinz QR code at your table got you some pornography.
Ketchup themed porn?
People complain about the web build tool chain, bundlers, rollups etc.
And it has been and probably still is pretty stupid.
But at least you can pin and deploy all your dependencies before deploying.This highlights why pulling in scripts at runtime from sources you don't control is a worse idea
This is the best summary I could come up with:
Multiple security firms sounded the alarm on Tuesday, warning organizations whose websites use any JavaScript code from the pollyfill.io domain to immediately remove it.
More than 100,000 sites are already carrying the hostile scripts, according to the Sansec security forensics team, which on Tuesday claimed Funnull, a Chinese CDN operator that bought the polyfill.io domain and its associated GitHub account in February, has since been using the service in a supply chain attack.
Since February, "this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io," Sansec, an e-commerce security company, warned, adding that any complaints about the malicious activity are quickly vanished from the GitHub repository.
In February, he said he had nothing to do with the domain name's sale, and presumably the associated GitHub repo, to the Chinese CDN, and urged everyone to remove its code from their webpages as a precaution following the change in ownership.
Soon after other popular CDN providers including Fastly, where Betts works today, and Cloudflare created mirrors of polyfill.io so that sites could continue to use the code for the meanwhile without having to load in stuff from a Chinese entity.
"The concerns are that any website embedding a link to the original polyfill.io domain will now be relying on Funnull to maintain and secure the underlying project to avoid the risk of a supply chain attack," Cloudflare's Sven Sauleau and Michael Tremante said in February.
The original article contains 657 words, the summary contains 238 words. Saved 64%. I'm a bot and I'm open source!
This is not a supply chain attack, it is sudden extreme enshitification. according to the article, the attacker also bought the GitHub repo, so all releases should be considered tainted. The community will have to find a fork from before the acquisition and hope that there are no pre-purchase favors smuggled in.
This is not a supply chain attack, it is sudden extreme enshitification. according to the article, the attacker also bought the GitHub repo
I don't see how buying the GitHub repo as well makes it not a supply chain attack but enshitification.
They bought into the supply chain. It's a supply chain attack.
I thought Polyfill was a Google thing. I remember when they implemented it on YouTube and the Firefox performance was dire.
The polyfill.io domain is being used to infect more than 100,000 websites with malware after a Chinese organization bought the domain earlier this year.
Another post: Polyfill supply chain attack hits 100K+ sites
So, one would add
* polyfill.io * blockTo their My Filters pane in ublock origin?
This setting appears to work for me. It shows up as blocked in the logs. I've also blocked it in NoScript for good measure.
Damn I had this on my noscript allowlist
