Digital Chicks People Focused Tech Powered Logo

Remove Polyfill.io From Your Website

The Internet exploded several weeks ago week about how Polyfill.io was injecting malicious code into websites that were linking to it from the CDN at the URL where it has been served for years.

What Is Polyfill.io

Polyfill.io is a tool that web developers use to make older browsers work better with new web features.

It helps by providing pieces of code (called polyfills) that fill in the gaps for older browsers.

This service is popular because it delivers the needed code efficiently and is regularly updated with new features. Developers can easily use it by adding a small piece of code to their website.

Overview of Polyfill Supply Chain Attack

Polyfill.io was originally made by the Financial Times’ web development team.

Earlier this year, it was bought by Funnull, a relatively unknown Chinese company.

In late June 2024, a security firm called Sansec found that Polyfill.io was being used to add harmful code to many websites. This code redirected users to scam sites and put their data at risk.

Soon after, Cloudflare began rewriting requests to Polyfill.io to use their own safe version, and Namecheap put the domain on hold to stop the attack temporarily.

Despite these actions, it’s still recommended to remove any Polyfill.io references from your website code.

Who is Affected by the Polyfill.io Attack

If your website uses Polyfill.io instead of hosting the polyfills yourself or using a service like Cloudflare or Fastly, you might be affected.

You can check by searching your website code for mentions of polyfill.io.

Looking for peace of mind and less tech stress?​

Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.

Signup for website management and get a tech-savvy team who are committed to your business.

Never worry about your website again.

Let Us Help You

What Can You Do to Protect Your Site

  • Remove any mentions of cdn.polyfill.io (and also Bootcss.com, Bootcdn.net, and Staticfile.org) from your code.
  • Use alternative, trusted sources for polyfills or stop using polyfills if they are not needed by modern browsers.
  • Regularly check your website for unusual activity, such as unauthorized redirects or data theft.
  • Use security tools to detect suspicious activity and stay updated on security news related to your libraries and services.
  • If you still need polyfills, consider using services from trusted companies like Cloudflare or Fastly.
  • Try to reduce the number of external scripts on your website, as each one is a potential security risk.

The Potential Impact on Google Ads

If users getting harmful scripts isn’t enough motivation, Google Ads has stopped showing ads on websites that spread harmful scripts from services like Polyfill.io, Bootcss.com, Bootcdn.net, and Staticfile.org.

The move is to (presumably) reduce traffic to them and cut the number of potential victims.

Sites whose Google Ads have been affected, have been alerted by Google.

Conclusion

The Polyfill.io attack is a reminder that our websites and the third-party services we use are vulnerable to attacks. It’s crucial to stay alert and follow good security practices for our websites and the third-party services we rely on.

FAQs

A (software) supply chain attack injects malicious code into an application or website in order to infect all users of that app or website.
A polyfill is a piece of code (usually JavaScript on the Web) used to provide modern functionality on older browsers that do not natively support it.

A July 5th report by The Hacker News says the supply chain attack targeting the widely-used Polyfill[.]io JavaScript library is broader in scope than previously thought, with new findings from Censys showing that over 380,000 hosts are embedding a polyfill script linking to the malicious domain as of July 2, 2024.

Tagged