Remove polyfill.io cheatsheet - the domain now serves malware

[Christopher-Hayes]

Description

The domain now serves a malicious script. Even before this security incident, it has been recommended that devs avoid it already.

Sources

The domain now serves malware: https://cside.dev/blog/more-than-100k-websites-targeted-in-web-supply-chain-attack

The cdn.polyfill.io domain is currently being used in a web supply chain attack. It used to host a service for adding JavaScript polyfills to websites, but is now inserting malicious code in scripts served to end-users.

Similar GitHub issues discussing its removal:

• format.js: Polyfill.io has been sold to a weird Chinese company and should no longer be recommended formatjs/formatjs#4363
• Node.js: polyfill.io supply chain nodejs/package-maintenance#603
• Core.js: Security - Remove reference to compromised polyfill.io service zloirock/core-js#1350
• Google: Replacing polyfill.io googlemaps/js-samples#1674

Polyfill.io creator:

If your website uses polyfill.io, remove it IMMEDIATELY.
I created the polyfill service project but I have never owned the domain name and I have had no influence over its sale.

No website today requires any of the polyfills in the polyfill.io library. Most features added to the web platform are quickly adopted by all major browsers, with some exceptions that generally can't be polyfilled anyway, like Web Serial and Web Bluetooth.

- posted on X/Twitter

Solution

It's most important that cheatsheets no longer helps users install polyfill.io from a malicious domain.

However, it might be a good idea to notify users that they should no longer use polyfill.io, rather than completely removing the cheatsheet without notice.