POLYFILL.IO JAVASCRIPT SUPPLY CHAIN ATTACK IMPACTS OVER 100K SITES

Summary from the TLDR InfoSec newsletter

Over 100,000 websites were affected by a supply chain attack on the Polyfill.io service where a script was modified to redirect users to malicious sites. Polyfill.io is a service that provides code that enables modern browser features on older browsers. It was compromised after being acquired by a Chinese company. Cloudflare and Fastly created their own mirrors of the service to mitigate risks.