Loading story…
The polyfill.io CDN, embedded by more than 100,000 websites to deliver the Polyfill JavaScript library, was turned into a malware distribution channel after the domain and related GitHub account were reportedly acquired by a Chinese company. Researchers said the injected JavaScript selectively targeted visitors—especially mobile users—and redirected some of them to a sports betting site through spoofed analytics infrastructure. The malicious code also used anti-analysis techniques, including device checks, delayed execution, time-based activation, and logic to avoid triggering for administrators or when analytics tools were detected.
The incident prompted broad mitigation efforts across the ecosystem. Cloudflare introduced real-time rewrites for cdn.polyfill.io, Namecheap later placed the domain on hold and then took it down, and Google began warning advertisers and blocking Google Ads for eCommerce sites still loading the compromised service. Security firms advised organizations to remove all polyfill.io references from source code because modern browsers generally no longer require the library; where compatibility support is still needed, they recommended replacing it with safer alternatives from providers such as Cloudflare or Fastly.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
Google began blocking Google Ads for eCommerce sites whose landing pages still referenced polyfill.io, warning advertisers affected by the compromised service.
Cloudflare implemented real-time rewrites for cdn.polyfill.io requests to reduce immediate risk for affected sites still referencing the service.
Namecheap took down or placed the polyfill.io domain on hold, stopping further malware delivery from that domain. This also left websites still depending on the service with broken polyfill functionality.
Sansec disclosed the compromise of cdn.polyfill.io and described it as a supply-chain attack impacting over 100,000 sites. The report also documented anti-analysis behavior such as device checks, delayed execution, admin-user exclusion, and time-based activation.
After the acquisition, the polyfill.io service was turned into a malware delivery channel affecting more than 100,000 websites that embedded the library. The malicious code selectively targeted users, including mobile visitors, and redirected some of them to a sports betting site under specific conditions.
Sansec reported that a Chinese company acquired the cdn.polyfill.io domain and the associated GitHub account in February 2024, setting up the conditions for the later supply-chain attack.
Fastly published guidance announcing new options for websites using Polyfill.io, providing an alternative path for customers relying on the service. This represents an earlier vendor response related to Polyfill.io usage before the later June 2024 compromise disclosures and mitigations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
semgrep.dev
Open sourcecsirt.sk
Open sourcesansec.io
Open sourcecommunity.fastly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply chain compromise of the widely used **Polyfill.io** JavaScript service exposed a vast number of websites after the `cdn.polyfill.io` domain began serving malicious code to visitors. Reporting from BleepingComputer, The Hacker News, Censys, and Italy’s CERT-AgID said the incident initially affected more than **100,000** sites and was later tied to over **380,000 hosts**, including major companies. The injected code redirected users to scam and fraudulent pages and created a risk of sensitive data theft, turning a trusted browser compatibility library into a large-scale web skimming and traffic hijacking vector. CERT-AgID urged public administrations to **immediately remove** all Polyfill.io references from their sites, warning that the service could no longer be trusted even after Namecheap suspended and reclaimed the malicious domain. The agency said it had already taken mitigation steps for affected public-sector entities and was removing the plugin from its own exposed systems. Security researchers also advised organizations to audit dependencies, replace Polyfill.io with safer alternatives or self-hosted code, and verify that no lingering references to the compromised service remain in production environments.
Jun 29, 2026
Toshiba and Muji warned visitors that suspicious browser sign-in prompts appeared on their websites after residual references to **`polyfill[.]io`** began returning HTTP `401` authentication responses. The behavior caused browsers to display what looked like legitimate login dialogs, creating a risk that users could hand over credentials. Reports said the same issue also affected other Japanese organizations, including **Zojirushi** and **FiNC Technologies**, and was observed on some Samsung Smart TVs and related websites. The incident is tied to the troubled **`polyfill[.]io`** domain, which was widely abused in 2024 after its acquisition by a Chinese entity led to malicious code being served to more than 100,000 websites. In the latest case, affected companies said they mitigated the problem by suspending use of the external service. No confirmed website compromise, unauthorized access, or credential theft has been reported, but users who entered passwords into the prompts were advised to change them as a precaution.
Jun 29, 2026
Researchers identified a malicious npm supply-chain campaign that impersonated Rollup polyfill tooling to compromise developer workstations and CI/build systems. The primary packages, **`rollup-packages-polyfill-core`** and **`rollup-runtime-polyfill-core`**, mimicked legitimate Rollup-related projects and used staged dependencies including **`swift-parse-stream`**, **`quirky-token`**, **`react-icon-svgs`**, and **`rollup-plugin-polyfill-connect`** to trigger a multi-stage infection chain. The malware fetched obfuscated code from JSONKeeper, decrypted additional payloads retrieved from **`216.126.236.244`**, and executed them locally while using evasive checks to avoid some analysis and cloud development environments. The final payloads gave attackers remote access and enabled theft of browser data, crypto-wallet information, files, clipboard contents, and other developer secrets such as source code, tokens, SSH keys, and cloud credentials. JFrog said the layered package structure, lookalike naming, and tradecraft resemble earlier Lazarus-linked npm operations, while additional reporting tied the activity to a broader North Korea-linked supply-chain effort referred to as **PolinRider**. Some malicious packages were replaced with security-holding versions, but others remained available at the time of reporting, prompting guidance to remove the packages, treat affected hosts as compromised, rotate credentials, and block related outbound traffic.
Jul 12, 2026