#polyfillio — Public Fediverse posts

What CVE should I use for the Polyfill[.]io supply chain attack? I see that CVE-2024-38526 exists, but it's specifically for pdoc. Is there a better one?

:boost_love:

#PolyfillIO #CVE #infosec

Y'all remember #PolyfillIO?

I realize the lesson there is; don't depend on code from domains you don't control, and in an ideal world that's what you should do

But is there still a need there? Are there #webPlatform features you'd like to use but you don't want to introduce a build process just to bundle the #polyfill from #NPM?

Or is there no point in #polyfills since #browsers don't share caches between origins these days so there's no precaching benefit anymore?

#webDev #javaScript #web

So, I'm thinking; what if I build polyfill.io, but on the Blockchain! Hey come back..

Hear me out; #fleekfunctions are immutable, and transparent. So long as the #fleeknetwork nodes can be trusted to execute the code properly (I presume there are cryptographic guarantees of output validity) then it could be safer from supply chain attacks.

#webDev #polyfillio #polyfill #supplyChain #hacking #web3 #blockchain #fleek #javaScript

On July 5th, PolyfillIO switched to polyfill[.]top
This domain is currently unblocked by uBlock Origin and all major blocklists.
Tweet: https://x[.]com/Polyfill_Global/status/1809122842145141114
Thread with more information and also making fun of Windows users.

#PolyfillIO #PolyfillIOAttack

384,000 sites pull code from sketchy code library recently bought by Chinese firm | @dangoodin

A supply-chain attack on Polyfill.io, a #JavaScript library, redirected users to malicious sites. So far, bootcss.com is the only domain showing any signs of potential malice. The nature of the other associated endpoints remains unknown

#CyberSecurity #SupplyChainAttack #WebDevelopment #WebProgramming #WebSecurity #Polyfill #PolyfillIO

https://arstechnica.com/security/2024/07/384000-sites-link-to-code-library-caught-performing-supply-chain-attack/

> #China-based company #Funnull acquired the domain and the GitHub account that hosted the #JavaScript code. On June 25, researchers from #security firm Sansec reported that code hosted on the polyfill domain had been changed to redirect users to adult- and gambling-themed websites. The code was deliberately designed to mask the redirections by performing them only at certain times of the day and only against visitors who met specific criteria.

https://arstechnica.com/security/2024/07/384000-sites-link-to-code-library-caught-performing-supply-chain-attack/

#polyfillio #supplyChain

If you're using #polyfillio code on your site – like 100,000+ are – remove it immediately

https://www.theregister.com/2024/06/25/polyfillio_china_crisis/

#JavaScript-Service Polyfill.io: 100.000 Sites binden Schadcode über CDN ein | Developer https://www.heise.de/news/Jetzt-handeln-Schadcode-ueber-CDN-des-JavaScript-Service-Polyfill-io-verteilt-9778256.html #polyfillio

Polyfill.io, BootCDN, Bootcss, Staticfile attack traced to 1 operator
#CDN #CLOUDFLARE #POLYFILLIO #SUPPLYCHAINATTACK https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/

> The recent large scale supply chain attack conducted via multiple CDNs, namely Polyfill.io, BootCDN, Bootcss, and Staticfile that affected anywhere from 100,000 to tens of millions of websites has been traced to a common operator

> Researchers discovered a public GitHub repository where the purported operators of Polyfill.io had accidentally exposed their Cloudflare secret keys.

LOL, FAIL!

https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/

#polyfill #polyfillio #cloudflare #bootcdn #bootcss #staticFile #security

Large #supplychain attack conducted via multiple #CDN, namely #PolyfillIo #BootCDN, #Bootcss, & #Staticfile that affected anywhere from 100,000 to tens of millions of websites has been traced to common operator.
A GitHub repository where the purported operators of Polyfill.io had accidentally exposed their #Cloudflare keys.
Using leaked #API keys researchers were able to establish that common operator was behind all four domains, and wider #supplychainattack
https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/

Well, apparently we see the #polyfillio situation explode big time: https://www.bleepingcomputer.com/news/security/polyfillio-bootcdn-bootcss-staticfile-attack-traced-to-1-operator/

#infosec

JavaScript-Service Polyfill.io: 100.000 Sites binden Schadcode über CDN ein | heise online
https://heise.de/-9778256 #ContentDeliveryNetwork #CDN #Polyfillio

uBlock Origin has blocklisted polyfill[.]com

https://github.com/uBlockOrigin/uAssets/pull/24272

#uBlockOrigin #polyfillIo #polyfillIoAttack

#OpenSource libs routinely use polyfill.io. Just bc you arent using the compromised #CDN directly, one of your deps might be. We put together a list of recently released pkgs that ref polyfill.io!

#polyfill #polyfillio #malware

https://blog.phylum.io/a-note-about-polyfill

UBlock Origin is now blocking polyfill.io

Your regular reminder that AdBlockers are not just for hiding banner ads, they are also an indispensable tool for #privacy and #security

https://github.com/uBlockOrigin/uAssets/commit/91dfc54aed0f0aa514c1a481c3e63ea16da94c03

/cc @AmeliaBR

#polyfillio #ublock #supplyChain #polyfill #uBlockOrigin #adBlocker

GitHub has placed a warning on the PolyfillIO repository (https://github.com/polyfillpolyfill/polyfill-service), and has denied access for non-logged in users. The other two repositories owned by that account are unblocked. Dismissing the warning appears to be permanent for an account.

#PolyfillIo #polyfillIoAttack #GitHubSecurity

Re the #polyfillio malware issue:

I've seen a lot of people telling web developers to update any sites that use the service. But we all know there are countless unmaintained websites out there for small business and orgs.

The other thing that should be done is clientside, to block access to the URL so your browser won't download the malware even if a website asks it to.

Anyone got a good guide for doing that, at the individual browser or OS level? (For those without institutional firewalls.)

PolyfillIO maintainer denies they are serving malicious JavaScript

Someone has maliciously defamed us. We have no supply chain risks because all content is statically cached. Any involvement of third parties could introduce potential risks to your website, but no one would do this as it would be jeopardize our own reputation.

https://github.com/polyfillpolyfill/polyfill-service/issues/2890#issuecomment-2191461961

#polyfillIo #polyfillIoAttack

Related to @jeni's post on #Drupal Quicklink (https://drupal.community/@jeni/112683429949433765), there's also a #Webform risk, explained here:
https://www.drupal.org/project/webform/issues/3427662#comment-15655973

You're not vulnerable just by having Webform, you have to have enabled the Choices sub module both at system and field level.

HTH! #infosec #polyfill #polyfillio

Web services that deliver #javascript for execution in the browser shouldn't be trusted. #security #polyfillio

@KarlE Warum das eine schlechte Idee ist, demonstriert gerade Polyfill.io.

#polyfillio #polyfill #polyfillioattack #polyfail

If you're still using polyfill.io you probably want to replace/remove it IMMEDIATELY. The domain has been sold and the new owners are injecting #malware (1).

If you absolutely have to use externally hosted #JavaScript and #CSS, it's a good idea to secure it with #SubresourceIntegrity (2). It's supported by most old browsers you're probably polyfilling for.

(1) https://polykill.io/
(2) https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

#polyfillio #polyfillioattack #supplychainattack

Just added some more resources like old CNAME records, a link to archive org as well as a link to the GitHub thread discussing the payload.

Interesting part here: I haven't come across a second source for the payload yet. it always circles back to the GitHub issue from 5 days ago.

#polyfillio #polyfillioattack

Yikes, I've used polyfill dot io on projects before. I'm going back to check all my apps now.

https://sansec.io/research/polyfill-supply-chain-attack

#PolyfillIo

@GossiTheDog uBlock Origin has blocklisted PolyfillIO in it's badware list.

https://github.com/uBlockOrigin/uAssets/pull/24255

#uBlockOrigin #polyfillIo #polyfillIoAttack

I started to collect some useful resources on my blog: https://shivering-isles.com/2024/06/helpful-resources-polyfill-supply-chain-attack

This will be a growing article regarding the polyfill.io supply chain attack.

#polyfillio #supplychain #infosec

From https://cyberplace.social/@GossiTheDog/112679115075367631
All credit to @GossiTheDog

Without CDN/Archived: https://web.archive.org/web/https://sansec.io/research/polyfill-supply-chain-attack

Polyfill[.]io is now serving malware.
This is why you should not rely embed third party scripts on your website.
Only load JavaScript from domains you own - and preferably, only load JavaScript you/your organization wrote.
Third party JavaScript is and will always be a threat to privacy and security.

#polyfillIo