polyfill.io (2024): What Happens When a CDN Domain Changes Hands
Summary
In June 2024, security researchers reported that the polyfill.io domain, whose JavaScript was embedded via script tag on a very large number of websites, was serving malicious code that redirected some mobile users to unrelated sites. The domain had been acquired by a new owner in February 2024, and the original project author publicly stated he had never owned the domain and advised sites to remove it.
Technical Root Cause
polyfill.io provided browser polyfills through a script tag pointing at the third-party domain. Every page load fetched and executed whatever that domain returned, dynamically, with no integrity pinning. When the domain changed ownership, every embedding site inherited the new owner's code by default. The injected behavior was reported to be conditional, activating selectively based on device and other factors, which made casual verification unreliable.
This maps to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), the same underlying pattern as the British Airways Magecart case, though the entry point here was domain ownership transfer rather than intrusion.
Why It Mattered
No system was hacked in the conventional sense. The attack surface was a business transaction: buying a domain that thousands of sites had chosen to trust indefinitely. Cloudflare and Fastly stood up mirror endpoints, and Google began warning advertisers whose landing pages referenced the domain.
OWASP / CWE Mapping
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
- OWASP A08:2021: Software and Data Integrity Failures
Lasting Impact
polyfill.io is the clearest recent argument that a third-party script tag is a standing grant of code execution to whoever controls that domain in the future, not just today. Practical mitigations are unchanged and well known: Subresource Integrity, self-hosting, and Content Security Policy restrictions on script sources.
How Safeguard Helps
Safeguard's supply chain analysis covers externally-loaded script dependencies alongside package dependencies, since a script tag pointing at a domain you do not control is a dependency in every meaningful sense, even though it never appears in a lockfile.
