We have been made aware of a supply chain attack that uses ‘polyfill.io’ and have taken steps to mitigate this.

Explanation
A polyfill is a piece of code (usually JavaScript) used to provide modern functionality on older browsers that do not natively support it. It is preferrable to achieve functionality natively but polyfills can be used when this is not possible. A prime example is catering for the (now depracated) Internet Explorer web browser, which didn’t support basic common styling, such as text-shadow.

Background
The ‘polyfill.io’ JavaScript library was originally created by the Financial Times development team in 2014, to automatically detect the features a browser is missing and serve up the appropriate polyfills. Meaning it wasn’t necessary to have to manually include polyfills for every relevant feature. It was subsequently picked up and used widely because of this, growing to global usage by 2019, and has been integrated into many of the world’s most well-known web applications.

Compromised
Previously ‘polyfill.io’ was open source and community maintained, with its code publicly available on GitHub. However, the ‘polyfill.io’ domain which hosts the library has been acquired by Chinese company, Funnull, with all traffic now pointing to their Baishan Cloud in China. Most concerning is that the scripts hosted here were found to have been modified and purposefully redirecting users to malicious and scam sites.

There are further risks associated with allowing an unknown foreign entity to manage and serve JavaScript within a web application. As well as observing and redirecting traffic, they can potentially steal usernames, passwords, and payment details directly as users enter the information in a web browser.

Impacted
We are seeing over 488,000 websites impacted by this, as they still use ‘polyfill.io’ in their code and/or instructions. Cloudflare co-founder and CEO, Matthew Prince, said that it could be as much as tens of millions of websites (4% of the web). These include global brands and services, such as:

• Intuit (QuickBooks)
• Google Maps
• Stripe
• JSTOR
• World Economic Forum
• The Guardian
• The Metro
• Nintendo
• PrivatBank (Ukraine)
• Egnyte
• EDF Energy
• Australian Government
• Egyptian Government
• Multiple UK Universities
• ISO (International Organisation for Standardisation)
• SpareRoom
• Wix
• BECU
• Tiffany & Co
• Virgin Atlantic
• Lamborghini

Mitigation
Top tier platforms have taken various actions:

• GitHub has marked the repository as malicious, which you can see here.
• Google Ads has sent out warnings to customers where ‘polyfill.io’ is detected on their landing pages and advised customers to review their code. If these malicious redirects occur then Google warn they will disapprove the related ads, in oder to keep end users safe.
• Google Maps has removed ‘polyfill.io’ from their instructions and advised all customers to review their code.
• Stripe has removed ‘polyfill.io’ from their instructions and advised all customers to review their code.

At Direction Forward, we have undertaken the following:

• Reviewed all managed sites for inclusion of ‘polyfill.io’ and removed it if applicable. Our development practice is to write native implementations and limit third-party dependencies wherever possible, so ‘polyfill.io’ will only have been utilised if part of a top tier provider platform or service, such as Google Maps.
• Searched all our codebases for mention of ‘polyfill.io’, for sites which are not managed, so we can contact the respective organisations and owners to either take action or instruct us to do so.
• Where the removal of ‘polyfill.io’ may cause issues in functionality, we are either replacing this with an alternative safe version, hosted by Cloudflare. Any of our managed sites using our advanced CDN protection will have had this done automatically.

Conclusion
This incident serves to heighten awareness about vulnerabilities in software supply chains, especially when relying on third-party services. It also reinforces that best practice is to limit external dependencies, over which one has more or less no control, as far as possible. Regular audits of any third-party services and libraries are strongly encouraged.

UPDATE, 2 July: The ‘polyfill.io’ domain name is now down. It appears to have been deactivated by the domain registrar, Namecheap, for malicious activity.