Over 110,000 websites using the open JavaScript library Polyfill for compatibility with older browser versions fell victim to malicious changes made to the library's code by the new project owner. Malicious code was embedded in the library, which is loaded onto websites via the domain cdn.polyfill.io, redirecting users to fraudulent sites (such as googie-anaiytics.com), betting companies, and online casinos.
The Polyfill project was sold in February to a company called Funnull from China, which gained access to the GitHub account and the polyfill.io website. A few months after the acquisition, the new owner organized a fraudulent monetization scheme involving redirecting some users to questionable websites. The redirection occurred with some probability, at certain times, and under conditions such as opening the site from a mobile phone and the absence of cookies indicating that the page was opened by the site administrator. When web analytics systems were detected on the site, the redirect was delayed for a few seconds to avoid being flagged in the statistics of such systems.
Notably, the new owner removes any complaints from GitHub mentioning suspicious activity or a change of ownership, apparently hoping that users will consider the automatic redirects to be an initiative of the authors of the originally open websites.
Polyfill users are advised to remove the code for loading the library through the cdn.polyfill.io host as soon as possible. It is noted that in modern realities, there is no longer a need for Polyfill since all major browsers sufficiently support Web API (Polyfill dynamically evaluates the current browser based on the User Agent header and generates functions implementing the missing methods, properties, and APIs for outdated browsers).
Those who still need Polyfill can use versions of the library distributed by Fastly and Cloudflare, or they can use a local copy based on the code from the repository with a fork created by the original project author. Mirrors were created in February due to doubts about the reliability of the new owner serveren polyfill.io. domænet Firefox update 127.0.2 fixing the problem with YouTube.
Kilde: opennet.ru
