flawopen.com/Incidents/polyfill-io-supply-chain-incident-june-2024
Polyfill.io Supply-Chain Attack (2024)
2024 incident: polyfill.io served conditional malicious JavaScript to some visitors. Remove the CDN reference; no CVE was assigned.
A restaurant puts an outside supplier’s bottle on every table. If the supplier changes what is inside, it can affect every guest who uses it, even when the restaurant has not changed its own menu.
Core Concepts & Subsystem Terms
Dynamic User-Agent Polyfilling- Serving JavaScript from another host that the browser executes in the embedding page’s context. A response that varies by request cannot be pinned by one fixed SRI hash.
Conditional Payload Evasion- A malicious response may be conditioned on visitor or page properties. Sansec documented such checks in one analyzed sample; that does not establish universal CDN behavior.
Domain Ownership Transfer Risk- A domain’s controller can change its DNS, hosting, or responses, changing the script bytes clients receive.
Subresource Integrity (SRI)- A cryptographic browser mechanism that validates script hashes before execution.
Framework mappings
- CWE reference for the weakness described in this guide: CWE-829
Incident Timeline
Sansec reported the domain and GitHub account changed hands; Fastly offered an alternative as a precaution.
Sansec published its analysis and a 100K+ site exposure estimate based on its own measurement.
Cloudflare announced automatic rewrites to its mirror; the domain was later put on hold. Remove old references rather than relying on temporary rewrites.
Step-by-Step Attack Flow
1. Domain Acquisition
Sansec reported that polyfill.io and its GitHub account changed hands in February 2024. Fastly described the ownership change as a risk and offered an alternative before malicious responses were reported. Fastly later said it learned of the attack when Sansec published its report; its February alternative was precautionary, not evidence it knew of malicious activity.
2. User-Agent & Header Filtering
A page referencing cdn.polyfill.io caused the visitor’s browser to fetch and execute the returned JavaScript in that page’s context. Sansec documented conditional checks in one sample; do not generalize them to every response.
3. Targeted Evasion & Payload Delivery
Sansec analyzed a malicious sample that conditionally redirected some mobile visitors. Its findings describe that sample, not every response or every site embedding the CDN.
4. Ecosystem Interventions
Cloudflare deployed rewrites to its mirror; Fastly offered a separately hosted alternative. Sansec reported Google Ads disapprovals for some e-commerce sites, not a blanket organic-search penalty.
Source Code: Flaw vs. Secure Implementation
<!-- VULNERABLE: Direct 3rd-party CDN script without integrity verification -->
<!DOCTYPE html>
<html>
<head>
<title>Production Web App</title>
<!-- Polyfill CDN serves arbitrary dynamic code controlled by third party -->
<script src="https://cdn.polyfill.io/v3/polyfill.min.js?features=default,Array.prototype.flat"></script>
</head>
<body>
<h1>Welcome</h1>
</body>
</html><!-- Build this file from a reviewed, version-pinned dependency. -->
<script defer src="/assets/vendor/polyfills.min.js"></script>Engineering & System Hardening Checklist
- ✓Search source, templates, CMS content, and built HTML for polyfill.io references; remove them and verify deployed pages no longer request that host.
- ✓If legacy-browser support is still required, bundle a reviewed, version-pinned polyfill in the build and serve the resulting static artifact locally.
- ✓Use a restrictive Content Security Policy as defense in depth; allow only script origins the application needs.
- ✓Review browser and CSP reports for unexpected script origins or redirects, and investigate affected pages and user reports.
- ✓Do not treat SRI as a substitute for dependency ownership review; use it only when exact script bytes are stable and the hash is verified.