IF YOU'RE USING POLYFILL.IO CODE ON YOUR SITE – LIKE 100,000+ ARE – REMOVE IT IMMEDIATELY

Summary from the TLDR newsletter

Polyfill.io is being used to infect websites with malware. Websites running any JavaScript code from the domain are advised to remove it immediately. The site previously offered code that added functionality to older browsers. A Chinese organization bought the domain earlier this year. Some popular CDN providers have created mirrors of the domain so sites can continue to use it without having to load the malicious code.