Case study: the polyfill.io CDN takeover (2024)

Polyfills add modern JavaScript features to older browsers. The polyfill.io service made that easy: a site added one script tag pointing at cdn.polyfill.io, and the service read each visitor's User-Agent header and returned only the polyfills that browser needed. Many sites added the tag years ago and never revisited it.

In February 2024 the domain and the project's GitHub account were sold to Funnull, a company with no track record in running the service. The project's original author publicly told sites to remove it, and Cloudflare warned on 2024-02-29 that sites now depended on a new, unknown operator. On 2024-06-25 Sansec reported that the service was injecting malicious code. Nothing had been hacked: the new owner of the domain served what it chose, and every site that embedded the tag ran it.

According to Sansec, the injected code redirected mobile users to a sports betting site through a domain posing as Google Analytics. It was selective by design: it activated only on certain mobile devices and at certain hours, stayed inactive when it found an admin cookie, and delayed itself when it detected a web analytics service, so site owners testing their own pages, and their analytics, were unlikely to see anything.

Redirects to scam sites were what was observed, but the capability was larger. A script loaded into a page runs with the page's full authority: it can read what users type, including card numbers and passwords on checkout and login pages, and send it anywhere the browser allows. That is why the response treated every embedding site as running untrusted code, whatever the payload of the day.

Subresource Integrity (SRI) lets a page say which exact bytes it expects from a script: the integrity attribute carries a hash, and the browser refuses a file that does not match. It is the standard defense against a CDN serving altered code, and it would have blocked this attack for a fixed file.

polyfill.io was not a fixed file. The service built a different bundle for each browser from the User-Agent header, so no single hash could match every visitor, and sites using it could not adopt SRI. That made the risk structural: the only safe options were to stop depending on the service or to replace it with fixed files you control. Many sites no longer needed it at all, because the browsers they support already implement the features it polyfilled.

Script tags hide in many places: page templates, CMS theme settings, tag managers, documentation generators such as pdoc, and third-party widgets that load further scripts. Search the source and the built output, and check what live pages actually load, because a tag manager or a widget can add a script that appears in neither.

# Source, templates and built output: references to polyfill.io and the
# other domains Sansec tied to the same operator on 2024-06-28
rg -n --hidden -e 'polyfill\.io' -e 'bootcdn\.net' -e 'bootcss\.com' -e 'staticfile\.net' .

# Every third-party script origin in the built site, with a count
grep -rhoE '<script[^>]+src="https?://[^/"]+' dist/ |
  sed -E 's/.*src="//' | sort | uniq -c | sort -rn

# A live page, as a browser receives it
curl -s https://www.example.com/checkout | grep -oE "https?://[^\"' ]*polyfill\.io[^\"' ]*"

Where you keep a third-party library, serve a fixed file, either self-hosted or from a versioned CDN URL, with an integrity hash and crossorigin="anonymous", and restrict where scripts may load from with a Content Security Policy. /domains/appsec/browser-security/security-headers/ and /domains/appsec/browser-security/cors-csp-browser-boundaries/ cover CSP in depth. A strict script-src would not have stopped a site that explicitly allowed polyfill.io, but it stops scripts that a compromised third party pulls in from further domains, and it makes the list of trusted origins explicit and reviewable.

# Self-host a fixed file and pin it: compute the SRI hash of the exact bytes you serve
curl -fsSLo vendor/lib.min.js https://cdnjs.cloudflare.com/ajax/libs/lib/1.2.3/lib.min.js
echo "sha384-$(openssl dgst -sha384 -binary vendor/lib.min.js | openssl base64 -A)"

# Reference it with the hash; the browser refuses the file if a single byte changes:
#   <script src="/vendor/lib.min.js"
#           integrity="sha384-<hash printed above>" crossorigin="anonymous"></script>

# And allow scripts only from origins you control:
#   Content-Security-Policy: script-src 'self'; object-src 'none'; base-uri 'none'

A script tag is a dependency like any package, but it is resolved by every visitor's browser at run time, with no lockfile and no review. The controls bring it back under the same discipline.

• Every external script tag delegates control of your page to whoever owns that domain, now and after any future sale.
• Treat a change of ownership of a dependency, a domain or a maintainer account as a security event, as in /domains/supply-chain/dependencies/case-study-event-stream/.
• Prefer fixed, versioned files you can hash over services that generate code per request.
• Warnings arrived four months early; an inventory with owners is what turns a warning into a removal.
• Selective payloads evade owners' own testing: check pages from the outside, as different devices see them.

The public record does not establish how many sites served malicious code to visitors, as opposed to embedding the script, or how many visitors were redirected; estimates of affected sites ranged widely and changed as researchers rescanned. Whether the injected code did anything beyond redirects, such as collecting form data, is not documented in the primary reports. The US Treasury's description of Funnull altering a code repository in 2024 matches polyfill.io but does not name it.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. Sansec: Polyfill supply chain attack hits 100K+ sites (2024-06-25, with updates)
2. Cloudflare: Polyfill.io now available on cdnjs, reduce your supply chain risk (2024-02-29)
3. Cloudflare: Automatically replacing polyfill.io links with Cloudflare's mirror (2024-06-26)
4. polyfill-service README before the sale: the service reads the User-Agent header of each request. Commit 0b850d5 (20 October 2023).
5. GitHub Advisory GHSA-5vgj-ggm4-fg62: pdoc embeds link to malicious CDN (CVE-2024-38526). Published 25 June 2024.
6. US Treasury: Treasury takes action against major cyber scam facilitator (2025-05-29)
7. MDN: Subresource Integrity
8. MDN: Content-Security-Policy script-src

Reference information

Tags

Browser securitySupply chain attacksSupplier and open source risk

SDLC phase

DevelopmentMaintenanceSecurity program

Role

AppSec engineersPlatform engineers and SREs

Download this guide as Markdown

Continue exploring