Polyfill[.]io Attack Impacts Over 380,000 Hosts, Including Major Companies

The Polyfill.io JavaScript library was compromised after its domain and repository changed hands, and malicious code was introduced that conditionally redirects visitors to adult and gambling sites; Censys identified over 380,000 hosts embedding the malicious polyfill endpoints and linked maintainers to a broader set of suspicious domains and 1.6M public-facing hosts, while registrars, CDNs, and security vendors have taken mitigations and warned of impacted packages and plugins.