Polyfill.io Supply Chain Attack Smacks Down 100K+ Websites

Security researchers report that the cdn.polyfill.io domain—used by more than 100,000 websites—has been compromised to serve obfuscated, dynamically generated JavaScript payloads that activate selectively (based on headers and device), redirect users to porn and sports-betting sites, and could enable formjacking, clickjacking, and broader data theft. Owners are urged to immediately remove references to the CDN, use self-hosted or vetted alternatives, and scan codebases for the malicious domain.