The polyfill.io domain was acquired by a Chinese entity (Funnull) from its original developer Andrew Betts, who immediately warned users to remove references. By June 2024, cdn.polyfill.io was injecting malicious JavaScript redirecting mobile users to gambling and scam sites. 100,000+ websites affected. Cloudflare took the "exceptional step" of rewriting HTML on the fly to replace polyfill.io references across all free-plan customer sites.
Sources: Cloudflare blog · Sansec research
PACKAGE_UNSAFE_SOURCE_URL + PACKAGE_SOURCE_URL_MISMATCH flag domain ownership change; CDN-served script bypasses package tools
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Partial | PACKAGE_UNSAFE_SOURCE_URL + PACKAGE_SOURCE_URL_MISMATCH flag domain ownership change; CDN-served script bypasses package tools |
| Socket | Missed | CDN-served script outside package analysis scope |
| Snyk | Missed | CDN-served script outside scope |
| Sonatype (Nexus) | Missed | CDN-served script outside scope |
| Black Duck | Missed | CDN-served script outside scope |
| Endor Labs | Missed | CDN-served script outside scope |