More than 110,000 websites using the open JavaScript library Polyfill for compatibility with older browser versions fell victim to malicious changes made to the library's code by its new owner. Malicious code was embedded in the library, which is loaded onto websites through the domain cdn.polyfill.io, redirecting users to fraudulent sites (e.g., googie-anaiytics.com), betting shops, and online casinos.
The Polyfill project was sold in February to a company called Funnull from China, which gained access to the GitHub account and the polyfill.io site. A few months after the acquisition, the new owner organized a fraudulent monetization scheme related to redirecting some users to dubious websites. The redirection triggered with a certain probability, at specific hours, and under conditions such as opening the site from a mobile phone and the absence of cookies indicating the page was opened by the site administrator. When web analytics systems were detected on the site, the redirect was delayed for a few seconds to avoid being registered in the statistics of such systems.
Notably, the new owner deletes any complaints from GitHub indicating suspicious activity or a change of ownership, apparently hoping users will consider the automatic transition an initiative from the authors of the originally open websites.
Polyfill users are advised to remove the code for loading the library through the host cdn.polyfill.io as soon as possible. It is noted that in modern realities, there is no longer a need for Polyfill, as all major browsers adequately support Web APIs (Polyfill dynamically assesses the current browser based on the User Agent header and generates functions for outdated browsers with implementations of missing methods, properties, and APIs).
Those who still need Polyfill can use the versions of the library distributed by Fastly and Cloudflare, or can use their own server local copy based on the code from the repository with a fork created by the original author of the project. Mirrors were created in February due to doubts about the reliability of the new owner. domain polyfill.io.
Source: opennet.ru
