polyfill.io and the scripts you load from strangers
Over 100,000 sites served malware because they loaded a script from a domain that changed owners. Check your pages.
This week, sites that loaded a script from polyfill.io started sending some mobile visitors to scam pages. The domain had been sold earlier this year, and the new owner changed the code. More than 100,000 websites were affected, and they changed nothing themselves.
Every <script src="https://someone-else.com/..."> on your site lets that domain run code on your pages, with your visitors’ sessions. You’re trusting the domain owner today and whoever owns it next year.
What I check:
- List every external script on your pages: analytics, chat widgets, fonts, CDNs, A/B testing.
- Remove what you don’t need. Old polyfills are rarely needed in modern browsers.
- Host the rest yourself where the licence allows. Then a version only changes when you change it.
- For scripts that must stay remote, add Subresource Integrity (the
integrityattribute) so a changed file is blocked. - Add a Content-Security-Policy that lists the domains allowed to run scripts.
If you used polyfill.io, remove it today. Cloudflare and Fastly offer safe mirrors if you still need it.