polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites

What to do

Grep source, templates and built assets for polyfill.io, polyfill.com, bootcdn, bootcss and staticfile
Delete the script tags; most sites no longer need these polyfills
If you must keep polyfills, self-host them or use the Cloudflare or Fastly replacements
Add a Content Security Policy with an explicit script-src allow list
Use Subresource Integrity (integrity= attributes) for any static third-party script

How to check if you are affected or compromised

Run `grep -rniE 'polyfill\.(io|com)|bootcdn|bootcss|staticfile\.(net|org)'` across repos and deployed web roots
Scan your live pages (including CMS plugins and tag managers) for these domains with a crawler or CSP report-only mode
Check analytics for mobile-only redirect complaints or traffic leaking to betting sites around June 2024

What happened#

polyfill.io was a free CDN that served JavaScript shims so old browsers could run modern code, and many sites embedded it with a single script tag. On June 25, 2024 Sansec reported that cdn.polyfill.io had begun injecting malicious code. According to Sansec, a Chinese company had bought the domain and the project's GitHub account in February 2024. Cloudflare identifies the buyer as Funnull and says it warned about the risk at the time of the sale, when it set up a cdnjs mirror. The project's original author also raised concerns about the new owner.

The injected code was built to stay hidden. Sansec found that it targeted mobile devices only, activated at certain hours and with random probability, skipped visitors carrying admin cookies, and delayed itself when it detected web analytics. Victims were redirected to sports betting sites through a lookalike Google Analytics domain, www.googie-anaiytics.com. Because polyfill.io generated its response from request headers, the same channel could have delivered different payloads to different visitors. Cloudflare's Page Shield data first saw the malicious activity on June 8, 2024.

Who is affected#

Sansec put the initial count at more than 100,000 sites, including JSTOR, Intuit and the World Economic Forum. Cloudflare cited estimates that nearly 4% of all websites used polyfill.io. A week later, Censys counted 384,773 hosts still referencing cdn.polyfill.io or cdn.polyfill.com, 182 of them on .gov domains. Censys also linked four more domains to the same Cloudflare account: bootcdn.net, bootcss.com, staticfile.net and staticfile.org. Over 1.6 million hosts referenced at least one of them, and bootcss.com showed malicious activity dating back to June 2023. The counts measure different things (sites vs. hosts) and should not be compared directly.

Do you really need to act?#

The acute danger has passed. Namecheap suspended polyfill.io on June 27, 2024. From June 26, Cloudflare automatically rewrote polyfill.io links on proxied sites to its own mirror: on by default for free plans, opt-in for paid plans, and skipped when a page sends a CSP header. Google also began blocking Ads for e-commerce sites that used the domain.

A leftover reference still matters. A suspended domain can come back, and the sister domains were never part of the takedown. Every third-party script you load runs with full access to your page, including checkout forms. If a scan turns up any of these domains, clean it up this week. If not, the useful takeaway is policy: pin, self-host, or integrity-check third-party JavaScript.

What to do now#

Search everything, including source, templates, CMS themes and plugins, tag-manager containers and built bundles: grep -rniE 'polyfill\.(io|com)|bootcdn|bootcss|staticfile\.(net|org)' .
Delete the tags. Sansec notes that the original author advised dropping polyfill.io entirely, since modern browsers do not need it.
If you still need polyfills, self-host them or use the trustworthy replacements from Fastly or Cloudflare (cdnjs).
Add a CSP script-src allow list so an unexpected domain cannot load.
For static third-party files, add Subresource Integrity hashes.

How to tell if you were hit#

If your pages loaded cdn.polyfill.io between late February and June 27, 2024, your mobile visitors may have been served the redirect script. Sansec's evasion logic means you probably would not have seen it yourself as a logged-in admin on a desktop. Look for user complaints about unexpected redirects, CSP violation reports naming the lookalike analytics domain, or the indicator URLs Cloudflare published. Today, the check that matters is whether any page still references these domains.

Timeline#

Jun 2023 — Earliest malicious activity Censys tied to bootcss.com.
Feb 2024 — polyfill.io domain and GitHub account sold. Cloudflare publishes a mirror and warns.
Jun 8, 2024 — Cloudflare first sees malicious activity.
Jun 25, 2024 — Sansec discloses the compromise. Google starts blocking Ads for affected stores.
Jun 26, 2024 — Cloudflare enables automatic link rewriting.
Jun 27, 2024 — Namecheap suspends polyfill.io.
Jul 2, 2024 — Censys finds 384,773 hosts still referencing the domain.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.