---
title: "polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites"
url: https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/
description: "After a 2024 ownership change, cdn.polyfill.io served redirect malware to mobile visitors. Domain is suspended; remove every polyfill.io script tag."
type: security-brief
section: "Security Digest"
date_published: 2024-06-25
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# polyfill.io CDN Supply-Chain Compromise Hits 100K+ Sites

**Verdict: Check exposure.** The malicious domain has been suspended since June 27, 2024, but any page that still loads a script from polyfill.io or its sister domains is trusting an attacker-linked host and should be cleaned up.

- **Who must act:** Site owners whose HTML, templates, themes or plugins still reference cdn.polyfill.io, polyfill.com, or the related bootcdn, bootcss and staticfile domains.
- **Who can relax:** Sites that self-host their JavaScript, or that never used polyfill.io, are not affected, and modern browsers rarely need these polyfills at all.
- **Affected:** Any web page loading scripts from cdn.polyfill.io or cdn.polyfill.com; Pages loading from related actor-linked domains: bootcdn.net, bootcss.com, staticfile.net, staticfile.org
- **Fixed:** Remove the script tag; If polyfills are still needed: Cloudflare cdnjs mirror or Fastly-hosted alternative, or self-host
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Grep source, templates and built assets for polyfill.io, polyfill.com, bootcdn, bootcss and staticfile
2. Delete the script tags; most sites no longer need these polyfills
3. If you must keep polyfills, self-host them or use the Cloudflare or Fastly replacements
4. Add a Content Security Policy with an explicit script-src allow list
5. Use Subresource Integrity (integrity= attributes) for any static third-party script

### How to check if you are affected

- Run `grep -rniE 'polyfill\.(io|com)|bootcdn|bootcss|staticfile\.(net|org)'` across repos and deployed web roots
- Scan your live pages (including CMS plugins and tag managers) for these domains with a crawler or CSP report-only mode
- Check analytics for mobile-only redirect complaints or traffic leaking to betting sites around June 2024

## What happened

polyfill.io was a free CDN that served JavaScript shims so old browsers could run modern code, and many sites embedded it with a single script tag. On June 25, 2024 [Sansec reported](https://sansec.io/research/polyfill-supply-chain-attack) that `cdn.polyfill.io` had begun injecting malicious code. According to Sansec, a Chinese company had bought the domain and the project's GitHub account in February 2024. [Cloudflare identifies the buyer as Funnull](https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet) and says it warned about the risk at the time of the sale, when it set up a cdnjs mirror. The project's original author also raised concerns about the new owner.

The injected code was built to stay hidden. Sansec found that it targeted mobile devices only, activated at certain hours and with random probability, skipped visitors carrying admin cookies, and delayed itself when it detected web analytics. Victims were redirected to sports betting sites through a lookalike Google Analytics domain, `www.googie-anaiytics.com`. Because polyfill.io generated its response from request headers, the same channel could have delivered different payloads to different visitors. Cloudflare's Page Shield data first saw the malicious activity on June 8, 2024.

## Who is affected

Sansec put the initial count at more than 100,000 sites, including JSTOR, Intuit and the World Economic Forum. Cloudflare cited estimates that nearly 4% of all websites used polyfill.io. A week later, [Censys counted 384,773 hosts](https://censys.com/july-2-polyfill-io-supply-chain-attack-digging-into-the-web-of-compromised-domains) still referencing cdn.polyfill.io or cdn.polyfill.com, 182 of them on .gov domains. Censys also linked four more domains to the same Cloudflare account: bootcdn.net, bootcss.com, staticfile.net and staticfile.org. Over 1.6 million hosts referenced at least one of them, and bootcss.com showed malicious activity dating back to June 2023. The counts measure different things (sites vs. hosts) and should not be compared directly.

## Do you really need to act?

The acute danger has passed. Namecheap suspended polyfill.io on June 27, 2024. From June 26, Cloudflare automatically rewrote polyfill.io links on proxied sites to its own mirror: on by default for free plans, opt-in for paid plans, and skipped when a page sends a CSP header. Google also began blocking Ads for e-commerce sites that used the domain.

A leftover reference still matters. A suspended domain can come back, and the sister domains were never part of the takedown. Every third-party script you load runs with full access to your page, including checkout forms. If a scan turns up any of these domains, clean it up this week. If not, the useful takeaway is policy: pin, self-host, or integrity-check third-party JavaScript.

## What to do now

1. Search everything, including source, templates, CMS themes and plugins, tag-manager containers and built bundles: `grep -rniE 'polyfill\.(io|com)|bootcdn|bootcss|staticfile\.(net|org)' .`
2. Delete the tags. Sansec notes that the original author advised dropping polyfill.io entirely, since modern browsers do not need it.
3. If you still need polyfills, self-host them or use the trustworthy replacements from Fastly or Cloudflare (cdnjs).
4. Add a CSP `script-src` allow list so an unexpected domain cannot load.
5. For static third-party files, add Subresource Integrity hashes.

## How to tell if you were hit

If your pages loaded cdn.polyfill.io between late February and June 27, 2024, your mobile visitors may have been served the redirect script. Sansec's evasion logic means you probably would not have seen it yourself as a logged-in admin on a desktop. Look for user complaints about unexpected redirects, CSP violation reports naming the lookalike analytics domain, or the indicator URLs Cloudflare published. Today, the check that matters is whether any page still references these domains.

## Timeline

- Jun 2023 — Earliest malicious activity Censys tied to bootcss.com.
- Feb 2024 — polyfill.io domain and GitHub account sold. Cloudflare publishes a mirror and warns.
- Jun 8, 2024 — Cloudflare first sees malicious activity.
- Jun 25, 2024 — Sansec discloses the compromise. Google starts blocking Ads for affected stores.
- Jun 26, 2024 — Cloudflare enables automatic link rewriting.
- Jun 27, 2024 — Namecheap suspends polyfill.io.
- Jul 2, 2024 — Censys finds 384,773 hosts still referencing the domain.

## Sources

1. [Sansec — Polyfill supply chain attack hits 100K+ sites](https://sansec.io/research/polyfill-supply-chain-attack)
2. [Cloudflare — Automatically replacing polyfill.io links with Cloudflare's mirror for a safer Internet](https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet)
3. [Censys — July 2: Polyfill.io Supply Chain Attack: Digging into the Web of Compromised Domains](https://censys.com/july-2-polyfill-io-supply-chain-attack-digging-into-the-web-of-compromised-domains)

---
Source page: https://erroneo.us/security/briefs/polyfill-io-cdn-supply-chain-compromise/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt