The Polyfill.io software supply chain attack: Lessons learned

Sansec disclosed that the community-run Polyfill.io CDN — sold to Funnull — was modified to push malicious JavaScript to sites that embed cdn.polyfill.io, injecting malware on mobile devices and redirecting users to spam; researchers provided IoCs, noted anti-analysis protections in the payload, and advised web maintainers to remove the CDN and use scanning/remediation tools such as Polykill.io.