Polyfill.io JavaScript supply chain attack impacts over 100K sites

A supply-chain compromise of the widely used polyfill.io service occurred after the domain was acquired by a Chinese company ('Funnull') and the hosted script was altered to inject malicious code that redirects visitors (especially on specific mobile devices) to scam sites and can deliver malware; this impacts hundreds of thousands of websites that embed cdn.polyfill.io, prompted Cloudflare/Fastly to offer mirrors, and has led Google to notify advertisers and disapprove affected ads.