how it happened
- whonew domain ownerbought polyfill.io
- the gapembedded script lineunchanged on every site
- the result100,000+ sitesvisitors redirected
what everyone assumed
A polyfill is the most ordinary kind of dependency, a small helper that smooths over browser quirks and asks nothing of you. Embedding one from a popular CDN feels like a settled, harmless decision, because that is what it has been for years. Trusting that the script will keep doing the small thing it has always done is the reasonable assumption, because nothing about it had ever changed.
what happened
The script kept loading, and the assumption held, right up until the thing serving it was no longer the same thing. The polyfill.io domain changed hands. Its original author publicly warned that he no longer controlled it and advised people to stop using it. For sites that had embedded the CDN line, nothing in their own code changed and nothing looked different. The same line now pulled whatever the new owner chose to serve, and the new owner chose to serve malware to some visitors.
step by step
- 100,000 plus sites embed one CDN lineTo load a helper script from polyfill.io.
- the domain changes handsThe original author warns that he no longer controls it.the assumption breaks here
- June 2024the script starts serving malwareNothing changes in the sites' own code.
- Cloudflare rewrites requests, the domain is heldCVE-2024-38526.
how it surfaced
The security vendor Sansec reported in June 2024 that cdn.polyfill.io was injecting malicious code, affecting more than 100,000 sites that embedded it, tracked as CVE-2024-38526. The fix was not in anyone’s own application: Cloudflare began rewriting the requests to a safe version, and the domain was eventually put on hold. The exposure had been live on every site that trusted the line, with no change visible on any of them.
A third-party script you embed is code you run on behalf of whoever controls it today, not whoever controlled it when you added it.
Ownership of a dependency can change without a single character of your own code changing.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe new owner starts sending harmful code to your visitors.what it costs youYour own website attacks your customers, without one line of your code changing.
- or it goes like thisit happenedSolarWinds / Sunburst, 2020howA genuine, signed update from a certified vendor carries a backdoor.what leavesa quiet way into your networkwho ends up with ita state intelligence service
- or it goes like thisit happenedtj-actions/changed-files, 2025howA build helper everyone uses is hijacked and its versions repointed.what leavessecret keys, printed into build logswho ends up with itanyone reading public logs
sources
your turn
what you can do about it
this week
List those external scripts and, for the ones that matter, check whether you can pin them to a known version or self-host them.
Open your site's source and count the scripts you load from domains you do not own. Most teams find more than they expected, and most cannot say who controls each one now. The polyfill line was findable in plain sight in any page that carried it. The hard part was that nobody was looking at the line, because it had always been fine.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →