POLYFILL SUPPLY CHAIN ATTACK HITS 100K+ SITES

Summary from the TLDR Web Dev newsletter

The popular Polyfill.js library, which has been acquired by a Chinese company, has been injecting malware into websites that use it, redirecting mobile users to malicious sites during specific hours and avoiding detection by delaying execution when web analytics services are present.