What is Polyfill.io?

Polyfill.io is a JavaScript library service that ensures compatibility across different browsers by providing polyfills—small pieces of code that enable modern features in older browsers. This is essential for web developers aiming to achieve uniform functionality across various browser versions.

The Current Threat

Over 100,000 websites have been compromised due to a supply chain attack involving Polyfill.io. After the service was acquired by the Chinese company Funnull in February 2024, malicious code was embedded into the JavaScript polyfills distributed through cdn.polyfill.io. This code primarily targets mobile users, redirecting them to malicious and scam websites.

WordPress Themes and Plugins at Risk

Many WordPress themes and plugins rely on external JavaScript libraries, including those from Polyfill.io. If your website or any plugins/themes you use are sourcing code from cdn.polyfill.io, you are at risk. High-profile sites, including Hulu and government websites, have been affected, highlighting the widespread nature of this threat.

Immediate Actions Required

1. Audit Your Website:
   • Identify and remove any dependencies on cdn.polyfill.io.
   • Check all themes and plugins for external scripts that might be using Polyfill.io.
2. Switch to Trusted Alternatives:
   • Use trusted services like Cloudflare or Fastly, which have set up safe mirrors for Polyfill.io.
3. Enhance Security Measures:
   • Implement a robust Content Security Policy (CSP) to restrict sources of executable scripts.
   • Utilize Subresource Integrity (SRI) to ensure third-party scripts have not been tampered with.
   • Regularly update and review all dependencies to maintain a secure codebase.

Why Immediate Response is Crucial

The malicious scripts can dynamically generate payloads based on HTTP headers, targeting specific users and evading detection. This can lead to severe consequences, including data theft, unauthorized redirects, and broader attacks on your website’s visitors.

Burzcast’s Proactive Protection

At Burzcast, we prioritize your security. We have already scanned and protected all current customers’ projects against this threat. Rest assured that your projects are safe from this specific vulnerability.

The Polyfill.io supply chain attack represents a significant threat to web security. Immediate action is required to remove compromised scripts and switch to trusted alternatives. By enhancing your website’s security measures and regularly auditing third-party dependencies, you can protect your site and its users from potential harm.

Stay vigilant and act now to safeguard your digital assets. For further details and support, please contact our security team.