Polyfill.io Supply Chain (June 2024): How One Acquired CDN Compromised 100K+ Websites

Incident summary

Polyfill.io was a JavaScript service that automatically delivered browser-specific polyfills (compatibility shims) so that developers could write modern JavaScript that still worked on older browsers. The service was created by Andrew Betts in 2013 and was widely adopted in the 2010s as a defensive control against browser fragmentation. At its peak, more than one million websites referenced cdn.polyfill.io in their HTML source. The service was donated to the Financial Times and later spun out to the Fastly CDN.

In February 2024, the polyfill.io domain and associated GitHub repository were sold by their then-owners to a Chinese company named Funnull. Per Andrew Betts' February 25, 2024 public statement, Betts had no involvement in the sale and explicitly advised that sites should not use the polyfill.io service after the ownership change. Despite that warning, more than 100,000 websites continued to reference the CDN, in many cases because the script tag had been added years earlier and was no longer actively maintained.

Per Sansec's June 25, 2024 investigation, by mid-June 2024 the Funnull-controlled polyfill.io CDN was conditionally serving malicious JavaScript to mobile users. The malicious payload redirected the user to a sports-betting site at kuurza.com and to related scam destinations. Cloudflare and Google responded the same day: Cloudflare auto-rewrote requests for cdn.polyfill.io to its own mirror on cdnjs, and Google blocked Google Ads from advertiser landing pages that included the polyfill.io script tag. Namecheap suspended the polyfill.io domain on June 27, 2024.

Attack technique

MITRE ATT&CK maps the operation primarily to T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), with T1189 (Drive-by Compromise) covering the end-user exploitation step and T1659 (Content Injection) covering the in-transit injection of malicious JavaScript into otherwise-legitimate websites. The technique chain is structurally simple: acquire an actively-used JavaScript CDN domain through a legitimate purchase, change the served content to include malicious code, conditionally activate the payload to evade detection.

The conditional activation is the operationally interesting detail. Per Sansec, the malicious payload was served only to specific mobile user agents (iOS Safari and Android Chrome) and only in specific geographies. The conditional logic ran in the served JavaScript itself and inspected the user agent string and other browser-environment signals before activating. Desktop-based scanning by Sansec and others did not see the malicious behavior on initial reproduction. Sansec identified the pattern only after testing from mobile devices in specific markets.

The domain-ownership-change vector is structurally novel in scale. Prior supply chain attacks against JavaScript ecosystems typically involved compromise of npm packages or developer accounts. The Polyfill.io case demonstrated that a legitimate purchase of a CDN domain, with no compromise involved, can repurpose a tier-zero JavaScript dependency for malicious use against tens of thousands of downstream sites. Funnull was not a threat actor in the conventional sense. Funnull was a legitimately-registered business entity that bought a domain through a normal commercial transaction. The change-in-control was the attack.

Cloudflare's auto-replacement response was the operationally significant defense move. Per Cloudflare's June 25, 2024 blog post, Cloudflare detected polyfill.io references in HTML served through its CDN and automatically rewrote those references to point at cdnjs.cloudflare.com's clean mirror. The rewrite was opt-out, not opt-in. Cloudflare treated the change as a security defense rather than a content modification. The decision was controversial because it represented Cloudflare modifying customer content without explicit per-customer consent, but it was widely accepted given the severity and customer education gap.

Impact and consequences

Per Sansec's June 25, 2024 investigation, more than 100,000 websites referenced the compromised polyfill.io CDN at the time of disclosure. Sansec listed notable affected sites including JSTOR, Intuit, the World Economic Forum, the Hulu marketing site, and Mercedes-Benz country sites. Many of those references were legacy script tags added in the 2010s and not actively maintained, which is why warnings from Andrew Betts in February 2024 did not produce remediation in the four-month window before the compromise was activated.

End-user impact was meaningful but contained by the conditional activation. The malicious payload activated only on specific mobile user agents in specific geographies, so the population that actually received the redirect was smaller than the 100,000 affected site count would suggest. End-users on iOS Safari and Android Chrome in targeted markets were redirected to kuurza.com or related scam sites. Desktop users on the same sites typically saw no malicious behavior. The narrow targeting was a deliberate detection-evasion choice, not a reflection of the campaign's reach.

Cloudflare and Google's response substantially capped downstream damage. Cloudflare's auto-replacement covered websites served through Cloudflare. Google's Google Ads policy block on advertiser landing pages including the polyfill.io script tag pushed paid-traffic site operators to remediate within hours. Namecheap's domain suspension on June 27, 2024 cut the CDN off completely. The combined response window was less than 72 hours from Sansec's disclosure to functional containment of the active CDN. The structural exposure (100,000 sites with legacy script tags) remained for months afterward.

The broader industry consequence was renewed attention to JavaScript supply chain controls. Subresource Integrity (SRI) usage in production HTML rose noticeably in the months following the incident based on HTTP Archive data. Multiple major CDNs added explicit ownership-change notification commitments. The W3C resumed work on content-versioning standards for CDN-delivered third-party JavaScript. The npm ecosystem accelerated package provenance and supply chain attestation efforts that had been in progress under the OpenSSF banner.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Subresource Integrity (SRI) is a structural control against this class of attack. SRI lets you specify a SHA-256 hash of the expected script content in the script tag itself. If the served content does not match the hash, the browser refuses to execute it. SRI usage was negligible on most of the affected polyfill.io sites. Where SRI was in place, the malicious payload would have been rejected by the browser on its first served byte. OWASP's third-party JavaScript management cheatsheet is the reference document.

Inventory third-party JavaScript and audit it on a recurring schedule. The polyfill.io references on most affected sites were legacy script tags added years earlier and forgotten. Third-party JavaScript inventory should sit alongside vendor and dependency inventory in your asset management. Schedule quarterly review of script tags in production HTML and explicit revalidation of the upstream relationship for each. Andrew Betts' February 2024 warning would have been actionable for any organization that ran such a review.

Monitor CDN domain ownership changes as a security event. The change-in-control of polyfill.io from Andrew Betts to Funnull in February 2024 was the moment defenders had to act. WHOIS monitoring, certificate transparency log monitoring, and DNS-record monitoring on third-party JavaScript hosts surface that signal. Multiple security vendors now offer this as a CDN supply chain monitoring product. Build or buy that capability for the JavaScript dependencies you cannot easily self-host.

Self-hosting third-party JavaScript is a legitimate defensive control. Pulling polyfill.io content into your own CDN, version-pinning it, and serving from your origin defeats the change-in-control vector entirely. The trade-off is you take on the operational burden of monitoring upstream changes and updating your pinned version. For tier-zero JavaScript dependencies on customer-facing pages, that trade-off is usually worth making. Cloudflare's cdnjs mirror, Fastly's polyfill mirror, and self-hosted bundles are the post-incident replacements that most organizations adopted.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /careers/application-security-engineer
• /careers/devsecops-engineer
• /careers/security-architect

Related Decipher Files

• SolarWinds Sunburst: How Supply Chain Compromise Bypassed Every Endpoint Defense
• MOVEit Cl0p Cascade: How One Zero-Day Compromised Federal Agencies and Fortune 500

Frequently asked questions