Polyfill.io: domain and GitHub account bought in Feb 2024, CDN script then served malware to 100,000+ sites (no CVE)
Severity: high · Patch status: patched · Since 2024-06-25
In February 2024 the polyfill.io domain and its GitHub account were sold to a Chinese company that Cloudflare names as Funnull. Sansec reported on 2024-06-25 that scripts loaded from cdn.polyfill.io, embedded on more than 100,000 sites, had been serving malicious code that redirected some mobile visitors to a sports-betting site through a fake Google Analytics domain. The code was generated per request from HTTP headers, was obfuscated, ran only on certain mobile devices at certain times, skipped admins and delayed itself when analytics were detected. Cloudflare began rewriting polyfill.io script links on proxied sites to its own cdnjs mirror and Namecheap put the domain on hold on 2024-06-27, which Sansec says removed the immediate risk, though sites should still remove the references. Cloudflare notes the original author had also raised the concern that the new owner could inject code.
What to do
- Search code, templates and CMS content for polyfill.io (and cdn.polyfill.io) and remove the references; modern browsers do not need the polyfill.
- If a polyfill is still needed, point to Cloudflare's cdnjs mirror (cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js) or Fastly's, and add a CSP restricting script sources.
- Block outbound requests to googie-anaiytics[.]com and the further domains Sansec lists (kuurza.com, w9.vty70.net, newcrbpc.com, union.macoms.la, bootcdn.net, bootcss.com, staticfile.net, staticfile.org).
- Review web logs and RUM data for mobile visitors redirected to betting sites between February and June 2024.
Sources
All live incidents on Threat Watch
