Listen to this Post
Introduction:
A seemingly benign JavaScript library, Polyfill.io, once trusted by over 100,000 websites to provide modern functions for older browsers, was caught in a sophisticated supply chain attack. Following a acquisition by a Chinese company, the script began serving malicious code that redirected users to scam sites, demonstrating how a single dependency can become a critical threat to web security.
Learning Objectives:
- Understand the mechanics of the Polyfill.io supply chain attack and its impact.
- Learn how to detect and remove compromised dependencies from your web assets.
- Implement best practices to mitigate the risk of future supply chain attacks.
You Should Know:
1. The Anatomy of the Polyfill.io Heist
The Polyfill.io service was designed to deliver polyfill code—JavaScript that implements modern web features in older browsers. After its domain and GitHub account were acquired by the Chinese company Funnull, the script’s behavior changed. Instead of serving legitimate polyfills, it began detecting visitor attributes and, under specific conditions, redirecting them to malicious and scam websites. This turned a utility used by major websites into a widespread malware delivery mechanism.
Step-by-step guide explaining what this does and how to use it.
Step 1: The Acquisition. The original creator of Polyfill.io sold the project. The new owners gained control over the domain and the code repository.
Step 2: Code Obfuscation. The new, malicious code was heavily obfuscated to evade detection by security scanners and manual code reviews. It hid its true purpose within minified and scrambled JavaScript.
Step 3: Conditional Malware Delivery. The script was engineered to identify “fingerprints” of visitors, such as their user-agent string and referrer. It would only activate the malicious redirect for specific, targeted traffic, making the attack harder to notice during casual testing.
Step 4: The Payload. When conditions were met, the script would redirect users to unwanted, scam-filled pages, potentially leading to credential theft or further malware infection.
2. Detecting the Compromised Script on Your Website
The first step in remediation is identification. The malicious code was served from the `polyfill.io` domain and its related `cdn.polyfill.io` subdomain. Any website loading a script from these sources is potentially affected.
Step-by-step guide explaining what this does and how to use it.
Step 1: Inspect Your Source Code. Manually review your website’s HTML, JavaScript, and Tag Manager configurations for any references to polyfill.io.
Command Line Search (Linux/macOS):
grep -r "polyfill.io" /path/to/your/project/
Command Line Search (Windows PowerShell):
Get-ChildItem -Path "C:\path\to\your\project" -Recurse | Select-String "polyfill.io"
Step 2: Use a Security Scanner. Leverage automated tools to crawl your site and report on all external resources.
Using `nmap` for reconnaissance:
nmap --script http-scripts -p 80,443 yourwebsite.com
Step 3: Check Network Traffic. Open your browser’s Developer Tools (F12), go to the Network tab, and reload your page. Look for any network requests to polyfill.io.
3. Immediate Remediation and Removal
Once identified, the compromised script must be removed immediately. The cybersecurity community, including Cloudflare and Google, recommends completely removing the Polyfill.io service.
Step-by-step guide explaining what this does and how to use it.
Step 1: Delete the Script Tag. Locate and remove the offending `