Polyfill.io, a service that provides JavaScript polyfills for older browsers, was sold to a new owner in early 2024. Researchers from Sansec and other firms detected that the domain began serving malicious code to certain visitors. The injected code redirected users to adult sites, gambling pages, or fraudulent sites depending on conditions.
The service was embedded by many large websites, exposing millions of users to potential compromise. Cloudflare and Google both issued warnings and offered safe alternatives. Some advertising networks and platforms blocked the domain.
Website operators were advised to remove references to polyfill.io and replace them with trusted mirrors. The incident shows the danger of third party script dependencies. Supply chain attacks can affect thousands of sites through one compromised service.